Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 22:48
Static task
static1
Behavioral task
behavioral1
Sample
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce.dll
-
Size
230KB
-
MD5
2f78ff32cbb3c478865a88276248d419
-
SHA1
c4401bc85cdf162e3547645005060bd070e231a4
-
SHA256
84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce
-
SHA512
1d989e475b7fbfa1f5c2704b94e7037443ecfe27cca81ade92a28dc91b2cebc1e0b47c6280c794d1020758a90be2f7f4ce98b6827d3c6d2c82610f28afdb2248
Score
10/10
Malware Config
Extracted
Path
C:\DECRYPT-FILES.txt
Family
maze
Ransom Note
Attention!
----------------------------
| What happened?
----------------------------
All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms.
You cannot access the files right now. But do not worry. You have a chance! It is easy to recover in a few steps.
----------------------------
| How to get my files back?
----------------------------
The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers.
To contact us and purchase the key you have to visit our website in a hidden TOR network.
There are general 2 ways to reach us:
1) [Recommended] Using hidden TOR network.
a) Download a special TOR browser: https://www.torproject.org/
b) Install the TOR Browser.
c) Open the TOR Browser.
d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/8820099734336a1
e) Follow the instructions on this page.
2) If you have any problems connecting or using TOR network
a) Open our website: https://mazedecrypt.top/8820099734336a1
b) Follow the instructions on this page.
Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use.
On this page, you will see instructions on how to make a free decryption test and how to pay.
Also it has a live chat with our operators and support team.
----------------------------
| What about guarantees?
----------------------------
We understand your stress and worry.
So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer!
If you have any problems our friendly support team is always here to assist you in a live chat!
-------------------------------------------------------------------------------
THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU
---BEGIN MAZE KEY---
crk/KcX0c5EenprHslvI5EY1Oqks7EiQK+w49RCX7HXOYr9LBFvuQcZrJ4f5/z8ibmokMUGXEuDJHLMSvFD7z4LnddY9DFvKl++RzcQGJSz8fQEWnjBnHIdbYq44CP8BAh2liwGjaGKJ+OyJf2DpXiNXuOvNGSXuiOtVAn7H3C+N53ezVIoJBD5qH0F9uNFkdHE+3gt7JeYWpVlWx3IMzMf1jIoIPrSOpZ6z82PmWxoo1uSiWH6AMMzhsJaz58kPa5iNgEg/TlbbzKg78Rk5MthhuVSoR22sTgo9w6tzMmCsu5pJQW3s2a9mI0QbqJN4CwtIZCdgiT72230Y5fAvnCbfBvggpIAWYbDUR76ztdGPPN+VrJS/ouQhIaVZq2Mgn70lCDPo3LvwMg2haSqyl+a8yiv7ed02cPYui1JveJznUbz3iIZuJm28bb6i7DOvANUDoCO0vxQymuQ7yzJWpfw/QZSwP5DRACiK9ocHGB6fW+jS0SBc+Nbodz7OhxKkI5cygEqT9rfKdzn7rTrJt9j2hh4oljWnwpCPrn1bRmAABXv/+7ewHPZfIEO0qGVAYvfbKFtvAumQEdd1Qpjy2Z5+pUKCOvU8Cc8iQJSiH01LSud0PsAYrA0tLqBkNEtctknlU3vwjxLuafATiYcSDs1k3RskKajn4AbBQmYdqRnEHOWyMSlUca5FbDtbXaxLR/53n/SzoYha6TAu5IzDpb1ZwrV1ilcfc2XmO8HIEwpjlV+VZPaV2WtN0KhLIw8Zccmab3rbqtx6hdHJY87Yw7q6Cnth2wTtmJyie0uq1hsnHtsXN3Y+ICMXYUD22fcPSA3TMixYAYt9JDPa4JplntFKcD+7PQr4xXARnaRWmlhOR9JAeqL2y7XNebI8H369YMjwu70+qkAepJ0pxrddmGZoEc+DpRDw2qSPyeTh6cIKrN0T8Pn9UYVP5ZpGoLqt045XVtVzmpKv2+FqIxvggpTMWdX5SOUq+4oh+pHVHXda6WUkf70fLpdpPRVC3TCwXcUIanXbwXpbdcNsKhMPUBEOjZEHa8jAz4/ZueRhciGdWp8GzY1bZ6g2PISqyPfzoWNgq5bt76GTBhWFshCJIxOis1Hdn8q2ksWUZNSgaFWcIm5ZFdmvKY4eG+JrPObGO5gLAowqAfkdC0mpeLbqqQl3DQmHRWLkM/993DIUIqSgN0jtDcd1y90zyAS8pOVGOR1tegoM/elwfCfjwlO5BoBPXa/u5EQO8VHgBWUbolqdiIJBKyPGoBKiagKebYM8FM/usBe9pj5ILob/V3cklNUT3Ws+Q3Pnx+mJVf7HXp50jXeB2lHw+vG3CgkASMEFS3NYUmmxUpN5mfRGfh3Yh6m6MtWgXcU+oPYCLJ/n0P6WiuFE0aF50qNYBOMVSs2g9pgAvCZyRxH9VLVTklutsJDJyvNHNGcKa26lF1FIYeW/gXJ53a+cYkYCI3m3ZxGRm/83ExbrO/O3oABfm2IjPhbhTfHEJpvkZ2stWvUKeiWlcRQFqv9DSbbpTJ8O9O0c58tLArjjMB0kMnaQsDkmvfLFgY51h8xQ7f7tWMWmFsyxwHilDDTlUcO8ENetNuln/u2Oc4VBnajQEa0NOstFwL1ZJJMvhdcsG4EZoW15iX7uv6/wisEZUVHVmZE+XEustU3p88USZj0hTwvQ8W5mJC1ncJWSIpYLGwIz17O3PgvdC/XpguH9uwUvCrzSI3gTJ7Y7YJ4Q7S8rLqzjxehnvtI6UNdNVKVys8Z5QI+9Fo6vXQC5pqPmmeMeDwxEi3fSHX0H1ARvmOWqHDkkpUbJAsS5sl3AYpwepwoRUO9BIwhZUyD9JjV07Xa/Sx6/awb7Yasf3QMNnjQFjYqUS5ltBGseVaRFjobnd4lZMmJvdJGhJuJIy8Qk9M2P6hm6+1NNWiQ8OSFqjfGfPtkqx424Ast7JZ8Fy2HRFBEDy1FqmFUShjdGNzMUUl90sO8wvKoPGj1D2NSrkrozLAN/aTuuAja3an9lGw6Sjadr/FZE/S0dCz4cGIOUq0JUSxV6JzNqnXDXUHdLv6eCf2FMIIIXHD6XOjvZF888QxHrTPu8eWmU5izDEb1hEEtrvyq2iaNl9c8nibkWZFk/BSJQjKkFmn78HLALstIELAgu2ib2mCSoLB0OFu1XlEsR1T8ElicEuhGo5tzCL4q3GvRxX/tDJKPm64XCIxirJW5sRxfk2TRpxtuqikPkTZC4TxcfH4kWERapOwogOAA4ADIAMAAwADkAOQA3ADMANAAzADMANgBhADEAAAAQgGAaDEEAZABtAGkAbgAAACISTQBLAEwAVQBGAFYAUgBMAAAAKgxuAG8AbgBlAHwAAAAyHlcAaQBuAGQAbwB3AHMAIAAxADAAIABQAHIAbwAAAEI4fABDAF8ARgBfADIANAA0ADMAMwAxAC8AMgA2ADIAMAA0ADEAfABEAF8AVQBfADAALwAwAHwAAABIAFBAWIkIYIkIaIkIcJz/0nt4DoABAYoBBTIuMC45
---END MAZE KEY---
URLs
http://aoacugmutagkwctu.onion/8820099734336a1
https://mazedecrypt.top/8820099734336a1
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blacklisted process makes network request 13 IoCs
flow pid Process 13 1776 rundll32.exe 14 1776 rundll32.exe 15 1776 rundll32.exe 17 1776 rundll32.exe 18 1776 rundll32.exe 19 1776 rundll32.exe 20 1776 rundll32.exe 21 1776 rundll32.exe 22 1776 rundll32.exe 23 1776 rundll32.exe 25 1776 rundll32.exe 26 1776 rundll32.exe 27 1776 rundll32.exe -
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\CompareTest.raw => C:\Users\Admin\Pictures\CompareTest.raw.cCSVrn rundll32.exe File renamed C:\Users\Admin\Pictures\GetRestart.tiff => C:\Users\Admin\Pictures\GetRestart.tiff.XK0jKj rundll32.exe File renamed C:\Users\Admin\Pictures\InvokeReset.raw => C:\Users\Admin\Pictures\InvokeReset.raw.AOypJh5 rundll32.exe File renamed C:\Users\Admin\Pictures\SyncConvertTo.tif => C:\Users\Admin\Pictures\SyncConvertTo.tif.MxyeN rundll32.exe File opened for modification C:\Users\Admin\Pictures\GetRestart.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\LockUninstall.png => C:\Users\Admin\Pictures\LockUninstall.png.AOypJh5 rundll32.exe File opened for modification C:\Users\Admin\Pictures\RegisterShow.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\RegisterShow.tiff => C:\Users\Admin\Pictures\RegisterShow.tiff.VqVn rundll32.exe File renamed C:\Users\Admin\Pictures\SelectPublish.tif => C:\Users\Admin\Pictures\SelectPublish.tif.000F rundll32.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jozwqx7.tmp rundll32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\jozwqx7.tmp rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 37 IoCs
description ioc Process File opened for modification C:\Program Files\TraceConfirm.ttf rundll32.exe File opened for modification C:\Program Files\PingProtect.vst rundll32.exe File opened for modification C:\Program Files\SubmitUndo.pptx rundll32.exe File opened for modification C:\Program Files\UpdateShow.wma rundll32.exe File opened for modification C:\Program Files\CloseApprove.jtx rundll32.exe File opened for modification C:\Program Files\GrantDisable.DVR rundll32.exe File opened for modification C:\Program Files\ImportConvertFrom.otf rundll32.exe File opened for modification C:\Program Files\JoinSync.vdx rundll32.exe File opened for modification C:\Program Files\HideConvertFrom.asp rundll32.exe File opened for modification C:\Program Files\HideMeasure.aiff rundll32.exe File opened for modification C:\Program Files\jozwqx7.tmp rundll32.exe File created C:\Program Files\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files\CheckpointTrace.hta rundll32.exe File opened for modification C:\Program Files\DisconnectFind.M2TS rundll32.exe File opened for modification C:\Program Files\ExportImport.m4a rundll32.exe File opened for modification C:\Program Files\DenyImport.jfif rundll32.exe File opened for modification C:\Program Files\OutLimit.html rundll32.exe File opened for modification C:\Program Files\RequestShow.mpeg rundll32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files\ResumeSwitch.cab rundll32.exe File opened for modification C:\Program Files\SelectLimit.aiff rundll32.exe File opened for modification C:\Program Files (x86)\jozwqx7.tmp rundll32.exe File opened for modification C:\Program Files\FormatEnter.mpg rundll32.exe File opened for modification C:\Program Files\JoinSave.pub rundll32.exe File opened for modification C:\Program Files\LimitCompress.i64 rundll32.exe File opened for modification C:\Program Files\MountDebug.mp3 rundll32.exe File opened for modification C:\Program Files\UninstallRequest.cfg rundll32.exe File opened for modification C:\Program Files\UnlockClose.mht rundll32.exe File opened for modification C:\Program Files\EnableConvertFrom.vbe rundll32.exe File opened for modification C:\Program Files\ResumeCopy.ico rundll32.exe File opened for modification C:\Program Files\UnprotectNew.pot rundll32.exe File opened for modification C:\Program Files\SelectSuspend.mp3 rundll32.exe File opened for modification C:\Program Files\TestBackup.wav rundll32.exe File opened for modification C:\Program Files\BackupResolve.xps rundll32.exe File opened for modification C:\Program Files\ConvertEnable.doc rundll32.exe File opened for modification C:\Program Files\ExportCompress.mhtml rundll32.exe File opened for modification C:\Program Files\RestartInvoke.zip rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1776 rundll32.exe 1776 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4068 vssvc.exe Token: SeRestorePrivilege 4068 vssvc.exe Token: SeAuditPrivilege 4068 vssvc.exe Token: SeIncreaseQuotaPrivilege 876 wmic.exe Token: SeSecurityPrivilege 876 wmic.exe Token: SeTakeOwnershipPrivilege 876 wmic.exe Token: SeLoadDriverPrivilege 876 wmic.exe Token: SeSystemProfilePrivilege 876 wmic.exe Token: SeSystemtimePrivilege 876 wmic.exe Token: SeProfSingleProcessPrivilege 876 wmic.exe Token: SeIncBasePriorityPrivilege 876 wmic.exe Token: SeCreatePagefilePrivilege 876 wmic.exe Token: SeBackupPrivilege 876 wmic.exe Token: SeRestorePrivilege 876 wmic.exe Token: SeShutdownPrivilege 876 wmic.exe Token: SeDebugPrivilege 876 wmic.exe Token: SeSystemEnvironmentPrivilege 876 wmic.exe Token: SeRemoteShutdownPrivilege 876 wmic.exe Token: SeUndockPrivilege 876 wmic.exe Token: SeManageVolumePrivilege 876 wmic.exe Token: 33 876 wmic.exe Token: 34 876 wmic.exe Token: 35 876 wmic.exe Token: 36 876 wmic.exe Token: SeIncreaseQuotaPrivilege 876 wmic.exe Token: SeSecurityPrivilege 876 wmic.exe Token: SeTakeOwnershipPrivilege 876 wmic.exe Token: SeLoadDriverPrivilege 876 wmic.exe Token: SeSystemProfilePrivilege 876 wmic.exe Token: SeSystemtimePrivilege 876 wmic.exe Token: SeProfSingleProcessPrivilege 876 wmic.exe Token: SeIncBasePriorityPrivilege 876 wmic.exe Token: SeCreatePagefilePrivilege 876 wmic.exe Token: SeBackupPrivilege 876 wmic.exe Token: SeRestorePrivilege 876 wmic.exe Token: SeShutdownPrivilege 876 wmic.exe Token: SeDebugPrivilege 876 wmic.exe Token: SeSystemEnvironmentPrivilege 876 wmic.exe Token: SeRemoteShutdownPrivilege 876 wmic.exe Token: SeUndockPrivilege 876 wmic.exe Token: SeManageVolumePrivilege 876 wmic.exe Token: 33 876 wmic.exe Token: 34 876 wmic.exe Token: 35 876 wmic.exe Token: 36 876 wmic.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1400 wrote to memory of 1776 1400 rundll32.exe 70 PID 1400 wrote to memory of 1776 1400 rundll32.exe 70 PID 1400 wrote to memory of 1776 1400 rundll32.exe 70 PID 1776 wrote to memory of 876 1776 rundll32.exe 84 PID 1776 wrote to memory of 876 1776 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\84565919c48c0e959c2981301510228704dd74a7206ed660e7bfda06a980e5ce.dll,#12⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\system32\wbem\wmic.exe"C:\phc\olee\..\..\Windows\eey\wpwik\gk\..\..\..\system32\opkv\..\wbem\wrr\..\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:4068