Overview

overview

10

Static

static

3

48586ad6d4...21.exe

windows7-x64

10

48586ad6d4...21.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2024 17:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe

  • Size

    1.9MB

  • MD5

    40ec0e62856036983be04f31ce670fb9

  • SHA1

    0d04b8139fe71a1736a8168fbf072df61d7d7bd6

  • SHA256

    48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521

  • SHA512

    1094d49d3fcb757fe2d1c49d1e441ab086f4cff80ffd8572b0017546350838dcba83f102796009d811a360f6825928c13e3697b7dd462627bb83fb92534fc806

  • SSDEEP

    192:z/TeYoeb67sc8+otH8SESePujd2kTCMZehZtzMuuQzBLerxA/GWeGMEd022XbTFi:z/yYoebe5JotHESxjuM63KI

Score
10/10
makopevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\readme-warning.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Signatures

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
  • Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • Detects executables potentially checking for WinJail sandbox window 2 IoCs
  • Nirsoft 1 IoCs
  • Renames multiple (8212) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\45ce9615-6bb3-4fb0-baec-7575ccb1624c\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\45ce9615-6bb3-4fb0-baec-7575ccb1624c\AdvancedRun.exe" /SpecialRun 4101d8 2308
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2856
  • C:\Users\Admin\AppData\Local\Temp\45ce9615-6bb3-4fb0-baec-7575ccb1624c\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\45ce9615-6bb3-4fb0-baec-7575ccb1624c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\45ce9615-6bb3-4fb0-baec-7575ccb1624c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2308
  • C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
    "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Loads dropped DLL
    • Windows security modification
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2132
    • C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
      "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"
      2⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
        "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe" n2864
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Users\Admin\AppData\Local\Temp\f31d1468-8916-4c4a-abb0-54e5dc07e514\AdvancedRun.exe
          "C:\Users\Admin\AppData\Local\Temp\f31d1468-8916-4c4a-abb0-54e5dc07e514\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f31d1468-8916-4c4a-abb0-54e5dc07e514\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3052
          • C:\Users\Admin\AppData\Local\Temp\f31d1468-8916-4c4a-abb0-54e5dc07e514\AdvancedRun.exe
            "C:\Users\Admin\AppData\Local\Temp\f31d1468-8916-4c4a-abb0-54e5dc07e514\AdvancedRun.exe" /SpecialRun 4101d8 3052
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2672
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe" -Force
          4⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:268
        • C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
          "C:\Users\Admin\AppData\Local\Temp\48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe"
          4⤵
            PID:1832
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:2560
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:2680
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2416
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2976
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1428
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:2064
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:2128

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Privilege Escalation

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Defense Evasion

        Impair Defenses

        3
        T1562

        Disable or Modify Tools

        3
        T1562.001

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        4
        T1112

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Inhibit System Recovery

        3
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\readme-warning.txt
          Filesize

          1KB

          MD5

          e217e139ef30c6b01a891a46abdfdfdb

          SHA1

          b7fcffce07cbdc0408c8156f22ac6ab0a8c742c9

          SHA256

          cb631d734d62dce1742744b81cccd7418c27fa6da089d366378b43c00186598e

          SHA512

          a22208a2537138f0b70087b1f0f10972e2ed2feb3ea8ea2f7bc0f7668a4fc1b807aaa7173d04ff04d415c043e1278357d39c7f539b4037ebbc6926e21863d117

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          6fe21cd5badc7e2dab6848a95e02a6fc

          SHA1

          02102d79c2683c66e145cc2a314b5f0cfa0d66f6

          SHA256

          f7a416960a3d34d37f293e24621dad6cf6127341ac9072b14c4b2773bbacf12c

          SHA512

          5a039dc5784a7a8384a14350fd67d5b91bd786108a6eb797e836d793cd8c76e77d46b01473707fd3793b60f843b95106e6d20aeb76e1b082b41ffdf015656080

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\45ce9615-6bb3-4fb0-baec-7575ccb1624c\AdvancedRun.exe
          Filesize

          88KB

          MD5

          17fc12902f4769af3a9271eb4e2dacce

          SHA1

          9a4a1581cc3971579574f837e110f3bd6d529dab

          SHA256

          29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

          SHA512

          036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Cab781F.tmp
          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Tar78EC.tmp
          Filesize

          171KB

          MD5

          9c0c641c06238516f27941aa1166d427

          SHA1

          64cd549fb8cf014fcd9312aa7a5b023847b6c977

          SHA256

          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

          SHA512

          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
          Filesize

          7KB

          MD5

          9d8b931dbab04a35b637800b286602aa

          SHA1

          937bc400c5b968726528c045543fb53e0c2ee196

          SHA256

          32c95f446a356c5bee266e6b4ca622192772715b208a79491ff6079bc20b618f

          SHA512

          b86a7fa775833694ac0bed359f6c7a2bc9cdacb2e6d8d5350aad5a976d2a2b15c0b77b2eb0f3016ddb0454a0632a844d56d3ce5dee89255d042733da4a7fc6a2

          Download Submit

        • memory/268-63-0x0000000002860000-0x00000000028A0000-memory.dmp

          Filesize

          256KB

          Download

        • memory/268-61-0x0000000002860000-0x00000000028A0000-memory.dmp

          Filesize

          256KB

          Download

        • memory/268-60-0x000000006EE30000-0x000000006F3DB000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/268-62-0x000000006EE30000-0x000000006F3DB000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/268-64-0x000000006EE30000-0x000000006F3DB000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1832-260-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2036-18-0x0000000006C20000-0x0000000006C60000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2036-0-0x0000000001190000-0x0000000001384000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2036-35-0x0000000073FF0000-0x00000000746DE000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/2036-41-0x0000000073FF0000-0x00000000746DE000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/2036-1-0x0000000073FF0000-0x00000000746DE000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/2036-2-0x0000000000440000-0x000000000049E000-memory.dmp

          Filesize

          376KB

          Download

        • memory/2132-24-0x000000006EE70000-0x000000006F41B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2132-21-0x000000006EE70000-0x000000006F41B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2132-22-0x0000000002660000-0x00000000026A0000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2132-23-0x000000006EE70000-0x000000006F41B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2144-413-0x0000000073FF0000-0x00000000746DE000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/2144-37-0x0000000073FF0000-0x00000000746DE000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/2144-53-0x0000000006E10000-0x0000000006E50000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2864-25-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-36-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-34-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-65-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-32-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-30-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2864-29-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-1615-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-28-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-27-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-26-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2864-17522-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download