Extracted

• • Target

    48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521

  • Size

    1.9MB

  • MD5

    40ec0e62856036983be04f31ce670fb9

  • SHA1

    0d04b8139fe71a1736a8168fbf072df61d7d7bd6

  • SHA256

    48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521

  • SHA512

    1094d49d3fcb757fe2d1c49d1e441ab086f4cff80ffd8572b0017546350838dcba83f102796009d811a360f6825928c13e3697b7dd462627bb83fb92534fc806

  • SSDEEP

    192:z/TeYoeb67sc8+otH8SESePujd2kTCMZehZtzMuuQzBLerxA/GWeGMEd022XbTFi:z/yYoebe5JotHESxjuM63KI

  Score

  10^/10

  makopevasionransomwarespywarestealertrojanpersistence

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding command execution via IExecuteCommand COM object

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Detects executables potentially checking for WinJail sandbox window

  • Nirsoft

  • Renames multiple (8212) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Installed Components in the registry

    persistence

  • Stops running service(s)

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2