Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 13:14
Static task
static1
Behavioral task
behavioral1
Sample
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
Resource
win7
Behavioral task
behavioral2
Sample
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
Resource
win10v200430
General
-
Target
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
-
Size
363KB
-
MD5
7f152df418bbb484337fc8ed1383b27d
-
SHA1
fc433e7db24eb38690746575375d9890457e6711
-
SHA256
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0
-
SHA512
b6ebda7bd92d7248f18d796b808d0fd2cd7e1914ad51e3e3f2a0512a0d0a17e9b4bf6dd0d3e7cb1f239489d52ac5e666e17c27ab66b04a3ac0bd0783efef0f97
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6b170c9a9bc68372
https://mazedecrypt.top/6b170c9a9bc68372
Signatures
-
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6b170c9a9bc68372.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b170c9a9bc68372.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeBackupPrivilege 1060 vssvc.exe Token: SeRestorePrivilege 1060 vssvc.exe Token: SeAuditPrivilege 1060 vssvc.exe Token: SeIncreaseQuotaPrivilege 1900 wmic.exe Token: SeSecurityPrivilege 1900 wmic.exe Token: SeTakeOwnershipPrivilege 1900 wmic.exe Token: SeLoadDriverPrivilege 1900 wmic.exe Token: SeSystemProfilePrivilege 1900 wmic.exe Token: SeSystemtimePrivilege 1900 wmic.exe Token: SeProfSingleProcessPrivilege 1900 wmic.exe Token: SeIncBasePriorityPrivilege 1900 wmic.exe Token: SeCreatePagefilePrivilege 1900 wmic.exe Token: SeBackupPrivilege 1900 wmic.exe Token: SeRestorePrivilege 1900 wmic.exe Token: SeShutdownPrivilege 1900 wmic.exe Token: SeDebugPrivilege 1900 wmic.exe Token: SeSystemEnvironmentPrivilege 1900 wmic.exe Token: SeRemoteShutdownPrivilege 1900 wmic.exe Token: SeUndockPrivilege 1900 wmic.exe Token: SeManageVolumePrivilege 1900 wmic.exe Token: 33 1900 wmic.exe Token: 34 1900 wmic.exe Token: 35 1900 wmic.exe Token: SeIncreaseQuotaPrivilege 1900 wmic.exe Token: SeSecurityPrivilege 1900 wmic.exe Token: SeTakeOwnershipPrivilege 1900 wmic.exe Token: SeLoadDriverPrivilege 1900 wmic.exe Token: SeSystemProfilePrivilege 1900 wmic.exe Token: SeSystemtimePrivilege 1900 wmic.exe Token: SeProfSingleProcessPrivilege 1900 wmic.exe Token: SeIncBasePriorityPrivilege 1900 wmic.exe Token: SeCreatePagefilePrivilege 1900 wmic.exe Token: SeBackupPrivilege 1900 wmic.exe Token: SeRestorePrivilege 1900 wmic.exe Token: SeShutdownPrivilege 1900 wmic.exe Token: SeDebugPrivilege 1900 wmic.exe Token: SeSystemEnvironmentPrivilege 1900 wmic.exe Token: SeRemoteShutdownPrivilege 1900 wmic.exe Token: SeUndockPrivilege 1900 wmic.exe Token: SeManageVolumePrivilege 1900 wmic.exe Token: 33 1900 wmic.exe Token: 34 1900 wmic.exe Token: 35 1900 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1900 1496 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe 28 PID 1496 wrote to memory of 1900 1496 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe 28 PID 1496 wrote to memory of 1900 1496 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe 28 PID 1496 wrote to memory of 1900 1496 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe 28 -
Maze
Ransomware family also known as ChaCha.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1496 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Drops file in Program Files directory 45 IoCs
description ioc Process File opened for modification C:\Program Files\ConvertToConvert.xlt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\FindDisconnect.aif ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\GrantSkip.TTS ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\LockUnprotect.asf ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\6b170c9a9bc68372.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\MountCopy.xlsx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\AddCompare.vssx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ConnectPop.mpg ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\SubmitGrant.rmi ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\OutInstall.xlsb ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\StartEnable.hta ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\SwitchPing.ogg ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\DebugStop.wvx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\6b170c9a9bc68372.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\6b170c9a9bc68372.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\CompressDebug.xlt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RenameSkip.wav ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RequestConnect.vssx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\DisconnectUnpublish.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\GroupUninstall.cab ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\DismountTest.xml ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\MergeOptimize.cab ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\NewWrite.vsw ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RenameRedo.htm ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\SplitProtect.dib ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Program Files\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ClearConfirm.xlsx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\StartCheckpoint.m1v ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\Desktop\6b170c9a9bc68372.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\PublishMerge.dxf ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RequestUnpublish.php ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UnprotectStart.dwfx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UpdateShow.mp3 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ConvertFromUnlock.mpeg2 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\FormatDisconnect.mp3 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ReceiveDisconnect.3gp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UpdateRegister.dot ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files (x86)\6b170c9a9bc68372.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ApproveRepair.asp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ConvertFromCheckpoint.lock ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\BlockShow.cab ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe"C:\Users\Admin\AppData\Local\Temp\ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
PID:1496 -
C:\Windows\system32\wbem\wmic.exe"C:\nwird\l\xwys\..\..\..\Windows\mhyis\..\system32\in\qec\..\..\wbem\aewfi\cgu\emqfc\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1060