Overview

overview

10

Static

static

3

5ac385a18e...3f.exe

windows7-x64

10

5ac385a18e...3f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2024 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5ac385a18e905a102641064be708783f.exe

  • Size

    171KB

  • MD5

    5ac385a18e905a102641064be708783f

  • SHA1

    dda176956d5df2fda89aa567c610dd73141a509f

  • SHA256

    c648f1cae038bc878bc5f41fc7696112dcdb953cc2af59235c3c9708bd562f7a

  • SHA512

    088f28fd4757b2d35110c3088231a7d2d0c95817172cf72a62daf5e8f850ff62a2204208848f9ed0f7ec8a7b145e44497658649a45bf898c4886abd76a0b443d

  • SSDEEP

    3072:ovGyYiSDnt195GWp1icKAArDZz4N9GhbkrNEk1X8z1Adh6rQI4:M4Lp0yN90QEhjrQf

Score
10/10
makoppersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ClickToRun\readme-warning.txt

Ransom Note
All of your files have been encrypted. Your backup files as well. We have exfiltrated tons of your private data to our servers including data of your clients, dont believe us ? Read on. In order to restore your operations, avoid leaking/selling your data, and keep your business reputation intact, contact us directly on the below TOX ID as soon as possible. 1) TOX Download: https://tox.chat/ 2) TOX ID: 4A7F41CC6A5B87AF99450066F313C224D4E0E5501414670A8C5B802403E6292F859F178BB85F 3) Install TOX and add the TOX ID in the step 2 4) Share your personal ID over TOX chat (Do not send hello without your personal ID provided below) Upon contacting us, proof will be provided that we can decrypt your data, and samples of exfiltrated confidential information will also be provided. Although its not our intention , if you do not cooperate , we will not hesitate to make your data public including any confidential data , sell to your competitors/bidders , or send your clients their data just to make you look really bad and lose your clients trust , or even worse , being prosecuted for not telling your affected clients that their data has been compromised. Talking to law enforcement will only ensure that you don't get a decryption key and put your business reputation on the line. Attention! - Do not rename encrypted files. - Do not try to decrypt your data using third party software, it may cause permanent data loss. Your personal ID: 0FFF1DDF
URLs

https://tox.chat/

Signatures

  • MAKOP ransomware payload 1 IoCs
  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (7925) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ac385a18e905a102641064be708783f.exe
    "C:\Users\Admin\AppData\Local\Temp\5ac385a18e905a102641064be708783f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe" n4308
        3⤵
        • Executes dropped EXE
        PID:4260
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:4688
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:3472
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3776
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3740
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2804
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:4048
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\microsoft shared\ClickToRun\readme-warning.txt
      Filesize

      1KB

      MD5

      7f6752ddabbd93ac74a8518aeb6b4371

      SHA1

      d043c40059cef125b19566a275813de8ac85c731

      SHA256

      92b13e1d833848f4b23577168154d76a483f342a92dc153811e0b664b4d1e3f1

      SHA512

      7905b53ff52e02a939f8265b25885beb5b92df8f46a6fef7c578c6f6a6fd1785c734e4709744a0016cd1108c757744f602a83d0bcdd4146008ec295726ec84d9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
      Filesize

      34KB

      MD5

      951dce6731c5f3d2dae570597bc19d59

      SHA1

      cb32d6679e51d454bc9b3aa5ceb071302cbe2147

      SHA256

      eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73

      SHA512

      3ea6dca684a7671e3371740f9d91f8bc6b10119ae492949585e1bc8789b56f6d110f833f8684489fbfc4dda3d733fc127c242ae840cd262a89b44952dcc4fb09

      Download Submit