Overview

overview

10

Static

static

10

2024-11-08...op.exe

windows7-x64

9

2024-11-08...op.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-08_605f80f837e82c891c7fe7bbea34f5c8_makop

  • Size

    49KB

  • Sample

    241108-y5mqvsyjex

  • MD5

    605f80f837e82c891c7fe7bbea34f5c8

  • SHA1

    413661decc73d03c7e1313b96eb4ea0ade199ada

  • SHA256

    1b242153c890019bc4ac43fd4fa3d685bc8e634b98f64587736d7e3b00bad1de

  • SHA512

    2c87c6c5988ea768f3feb256d377327e921815c3be0bd13d41fcb2eb4c097ef8c6a43c6b37decce2053753df1db7c1028320bcc4c6827843664f3cb69d65c215

  • SSDEEP

    1536:YEpD183dAalnudHyFj6cBSfdYO8tNJo2M:ZpD18endsOcBSfaOA

Score
10/10
makopdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-11-08_605f80f837e82c891c7fe7bbea34f5c8_makop

    • Size

      49KB

    • MD5

      605f80f837e82c891c7fe7bbea34f5c8

    • SHA1

      413661decc73d03c7e1313b96eb4ea0ade199ada

    • SHA256

      1b242153c890019bc4ac43fd4fa3d685bc8e634b98f64587736d7e3b00bad1de

    • SHA512

      2c87c6c5988ea768f3feb256d377327e921815c3be0bd13d41fcb2eb4c097ef8c6a43c6b37decce2053753df1db7c1028320bcc4c6827843664f3cb69d65c215

    • SSDEEP

      1536:YEpD183dAalnudHyFj6cBSfdYO8tNJo2M:ZpD18endsOcBSfaOA

    Score
    9/10
    defense_evasiondiscoveryexecutionimpactransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (8306) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks