Behavioral task
behavioral1
Sample
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e.exe
Resource
win10v2004-20231215-en
General
-
Target
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e
-
Size
42KB
-
MD5
058cfb1586be0c7f1786d007111d66dc
-
SHA1
ba38e15a91965286b98b5303e840e83dfd1f63df
-
SHA256
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e
-
SHA512
8f69218bd5dc665ea9dd7d8e15bb26537742877e601646a021c2086210b91ee27ce801e0be768340495f63d99f861ff6c4b600352e49cdab0384ef8324e36e19
-
SSDEEP
768:oWo/YW1wUFGpQI1LSi/TqBKjBg1PuCu7bxGW60596iwL1gw6+fTmIHZDjC5siTms:oWzW1w1qI1rTEKjBgU9h596I+fTDBe5B
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule sample family_makop -
Makop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e
Files
-
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e.exe windows:4 windows x86 arch:x86
71964c01f21c7bdcdd5be87bbfa4df10
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
kernel32
CreateFileW
GetLastError
FindClose
FindFirstFileW
DeviceIoControl
GetDriveTypeW
WaitForMultipleObjects
SetErrorMode
FindNextFileW
TryEnterCriticalSection
Sleep
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
GetProcessHeap
GlobalAlloc
GlobalFree
GetVersion
GetFileAttributesW
GetCurrentProcess
HeapFree
PeekNamedPipe
GetProcAddress
LoadLibraryA
GetComputerNameW
SetEvent
CreateEventW
TerminateThread
OpenProcess
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetModuleHandleW
CreatePipe
GetCommandLineW
CreateToolhelp32Snapshot
GetSystemWindowsDirectoryW
GetLogicalDrives
GetLocaleInfoW
GetModuleFileNameW
GetEnvironmentVariableW
Process32FirstW
CreateProcessW
Process32NextW
CreateDirectoryW
CreateThread
WaitForSingleObject
GetVolumeInformationW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
HeapAlloc
SetHandleInformation
user32
DialogBoxParamW
KillTimer
ShowWindow
wsprintfA
MessageBoxW
SetWindowTextA
SendMessageW
GetWindowThreadProcessId
UnregisterHotKey
OpenClipboard
SetClipboardData
GetWindowTextLengthW
CloseClipboard
GetWindowTextA
EmptyClipboard
GetDlgItem
wsprintfW
GetShellWindow
SetTimer
SetWindowTextW
RegisterHotKey
EndDialog
EnableWindow
PostMessageW
advapi32
CryptGenRandom
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptReleaseContext
GetTokenInformation
SetTokenInformation
OpenProcessToken
DuplicateTokenEx
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptDecrypt
CryptAcquireContextW
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
ord680
ole32
CoUninitialize
CoTaskMemFree
CoInitialize
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ