Analysis
-
max time kernel
128s -
max time network
153s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
24-06-2020 13:14
Static task
static1
Behavioral task
behavioral1
Sample
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
Resource
win7
Behavioral task
behavioral2
Sample
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
Resource
win10v200430
General
-
Target
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
-
Size
363KB
-
MD5
7f152df418bbb484337fc8ed1383b27d
-
SHA1
fc433e7db24eb38690746575375d9890457e6711
-
SHA256
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0
-
SHA512
b6ebda7bd92d7248f18d796b808d0fd2cd7e1914ad51e3e3f2a0512a0d0a17e9b4bf6dd0d3e7cb1f239489d52ac5e666e17c27ab66b04a3ac0bd0783efef0f97
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d8b0cd2ec24b80a
https://mazedecrypt.top/6d8b0cd2ec24b80a
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1064 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe 1064 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d8b0cd2ec24b80a.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6d8b0cd2ec24b80a.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Maze
Ransomware family also known as ChaCha.
-
Drops file in Program Files directory 43 IoCs
description ioc Process File opened for modification C:\Program Files\DisconnectGet.mpeg ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\DisconnectPush.mp2 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RedoDisconnect.xla ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RestartWrite.mhtml ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UseMove.xps ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\GrantSkip.easmx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ResumeRedo.php ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\SaveResume.php ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\TestResolve.bmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\6d8b0cd2ec24b80a.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\GetLock.raw ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\PublishExit.midi ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\SendOut.html ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UnregisterDisable.3gp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\AssertDismount.rtf ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\EditRestart.mhtml ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\PingRead.pptx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UndoUse.search-ms ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RenameRedo.xhtml ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RepairComplete.aif ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UnblockDisable.rle ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File created C:\Program Files\DECRYPT-FILES.txt ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\FindMerge.iso ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\InvokeResolve.css ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\MountRead.ttf ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ProtectTest.tiff ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files (x86)\6d8b0cd2ec24b80a.tmp ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UninstallClose.bin ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\AssertRequest.csv ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ConvertUse.wpl ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\MergePush.m3u ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\SelectUnpublish.TS ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UninstallConvertFrom.dwg ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\PushOpen.asx ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\RequestSuspend.jfif ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\StopPing.jpg ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\ConnectRegister.csv ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\CopyResume.asf ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\CopyResume.mp2 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\GroupPublish.vssm ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\OutGroup.mp3 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe File opened for modification C:\Program Files\UnregisterTrace.ps1 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 1820 vssvc.exe Token: SeRestorePrivilege 1820 vssvc.exe Token: SeAuditPrivilege 1820 vssvc.exe Token: SeIncreaseQuotaPrivilege 3680 wmic.exe Token: SeSecurityPrivilege 3680 wmic.exe Token: SeTakeOwnershipPrivilege 3680 wmic.exe Token: SeLoadDriverPrivilege 3680 wmic.exe Token: SeSystemProfilePrivilege 3680 wmic.exe Token: SeSystemtimePrivilege 3680 wmic.exe Token: SeProfSingleProcessPrivilege 3680 wmic.exe Token: SeIncBasePriorityPrivilege 3680 wmic.exe Token: SeCreatePagefilePrivilege 3680 wmic.exe Token: SeBackupPrivilege 3680 wmic.exe Token: SeRestorePrivilege 3680 wmic.exe Token: SeShutdownPrivilege 3680 wmic.exe Token: SeDebugPrivilege 3680 wmic.exe Token: SeSystemEnvironmentPrivilege 3680 wmic.exe Token: SeRemoteShutdownPrivilege 3680 wmic.exe Token: SeUndockPrivilege 3680 wmic.exe Token: SeManageVolumePrivilege 3680 wmic.exe Token: 33 3680 wmic.exe Token: 34 3680 wmic.exe Token: 35 3680 wmic.exe Token: 36 3680 wmic.exe Token: SeIncreaseQuotaPrivilege 3680 wmic.exe Token: SeSecurityPrivilege 3680 wmic.exe Token: SeTakeOwnershipPrivilege 3680 wmic.exe Token: SeLoadDriverPrivilege 3680 wmic.exe Token: SeSystemProfilePrivilege 3680 wmic.exe Token: SeSystemtimePrivilege 3680 wmic.exe Token: SeProfSingleProcessPrivilege 3680 wmic.exe Token: SeIncBasePriorityPrivilege 3680 wmic.exe Token: SeCreatePagefilePrivilege 3680 wmic.exe Token: SeBackupPrivilege 3680 wmic.exe Token: SeRestorePrivilege 3680 wmic.exe Token: SeShutdownPrivilege 3680 wmic.exe Token: SeDebugPrivilege 3680 wmic.exe Token: SeSystemEnvironmentPrivilege 3680 wmic.exe Token: SeRemoteShutdownPrivilege 3680 wmic.exe Token: SeUndockPrivilege 3680 wmic.exe Token: SeManageVolumePrivilege 3680 wmic.exe Token: 33 3680 wmic.exe Token: 34 3680 wmic.exe Token: 35 3680 wmic.exe Token: 36 3680 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1064 wrote to memory of 3680 1064 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe 73 PID 1064 wrote to memory of 3680 1064 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe 73 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe"C:\Users\Admin\AppData\Local\Temp\ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\system32\wbem\wmic.exe"C:\s\..\Windows\kdqe\..\system32\qm\mylp\g\..\..\..\wbem\fl\wfva\sn\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1820