Overview

overview

10

Static

static

10

eee8150ba9...73.exe

windows7-x64

10

eee8150ba9...73.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2024 17:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73.exe

  • Size

    34KB

  • MD5

    951dce6731c5f3d2dae570597bc19d59

  • SHA1

    cb32d6679e51d454bc9b3aa5ceb071302cbe2147

  • SHA256

    eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73

  • SHA512

    3ea6dca684a7671e3371740f9d91f8bc6b10119ae492949585e1bc8789b56f6d110f833f8684489fbfc4dda3d733fc127c242ae840cd262a89b44952dcc4fb09

  • SSDEEP

    768:N+0DG/+G4RmQj4HjKbkpSndT6Rwh1llAok5zHDKZNhfwPdrQ+:pDGyRmQjoK9SwvDAh9eNJw1rQ+

Score
10/10
makopransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\readme-warning.txt

Ransom Note
All of your files have been encrypted. Your backup files as well. We have exfiltrated tons of your private data to our servers including data of your clients, dont believe us ? Read on. In order to restore your operations, avoid leaking/selling your data, and keep your business reputation intact, contact us directly on the below TOX ID as soon as possible. 1) TOX Download: https://tox.chat/ 2) TOX ID: 4A7F41CC6A5B87AF99450066F313C224D4E0E5501414670A8C5B802403E6292F859F178BB85F 3) Install TOX and add the TOX ID in the step 2 4) Share your personal ID over TOX chat (Do not send hello without your personal ID provided below) Upon contacting us, proof will be provided that we can decrypt your data, and samples of exfiltrated confidential information will also be provided. Although its not our intention , if you do not cooperate , we will not hesitate to make your data public including any confidential data , sell to your competitors/bidders , or send your clients their data just to make you look really bad and lose your clients trust , or even worse , being prosecuted for not telling your affected clients that their data has been compromised. Talking to law enforcement will only ensure that you don't get a decryption key and put your business reputation on the line. Attention! - Do not rename encrypted files. - Do not try to decrypt your data using third party software, it may cause permanent data loss. Your personal ID: 469965A0
URLs

https://tox.chat/

Signatures

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (8222) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73.exe
    "C:\Users\Admin\AppData\Local\Temp\eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73.exe
      "C:\Users\Admin\AppData\Local\Temp\eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73.exe" n2236
      2⤵
        PID:2196
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:1324
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          3⤵
          • Deletes backup catalog
          PID:2920
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1952
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2760
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:2636
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:2740

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\readme-warning.txt
          Filesize

          1KB

          MD5

          e33878e83761f41e564d87c6610fba72

          SHA1

          5cbd6ce7739eebe24fd3662339130359a09c0d49

          SHA256

          3dda66ae987ef2318556b22f67636b5a561fbdb9a966e40f630165d54b90cd9c

          SHA512

          3c1c89878fe9746b4bf4af374233ef8d4daeff48e46d4fa07a7ad0f672ffd0c5825f826d85586d916488650ccaecc752e6ecadff60300634d39096543295248e

          Download Submit