Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-12-2020 10:49
Static task
static1
Behavioral task
behavioral1
Sample
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
-
Size
473KB
-
MD5
f83fb9ce6a83da58b20685c1d7e1e546
-
SHA1
01c459b549c1c2a68208d38d4ba5e36d29212a4f
-
SHA256
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
-
SHA512
934ec9073a28b90e8df785bef49f224789da59f83729208b92dba0503e2894b3f48ed04b20de1ba49374b1cd26f0c87e8e5ab79e817258135e3be2c171f3f396
Score
10/10
Malware Config
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription ioc Process File renamed C:\Users\Admin\Pictures\CompressDisable.raw => C:\Users\Admin\Pictures\CompressDisable.raw.0GYdDyw e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File opened for modification C:\Users\Admin\Pictures\FindResize.tiff e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\FindResize.tiff => C:\Users\Admin\Pictures\FindResize.tiff.sFLW7Vi e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\PublishRestart.raw => C:\Users\Admin\Pictures\PublishRestart.raw.g7Yy e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\UnregisterDisable.png => C:\Users\Admin\Pictures\UnregisterDisable.png.RL0Eb e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\ConfirmRevoke.raw => C:\Users\Admin\Pictures\ConfirmRevoke.raw.0GYdDyw e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\DisconnectInvoke.tif => C:\Users\Admin\Pictures\DisconnectInvoke.tif.0GYdDyw e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File opened for modification C:\Users\Admin\Pictures\PushDisable.tiff e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\PushDisable.tiff => C:\Users\Admin\Pictures\PushDisable.tiff.g7Yy e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\SubmitOpen.tif => C:\Users\Admin\Pictures\SubmitOpen.tif.RL0Eb e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Drops startup file 4 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8uuuy.dat e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\8uuuy.dat e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exepid Process 648 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 648 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Suspicious use of AdjustPrivilegeToken 89 IoCs
Processes:
wmic.exevssvc.exewmic.exedescription pid Process Token: SeIncreaseQuotaPrivilege 1424 wmic.exe Token: SeSecurityPrivilege 1424 wmic.exe Token: SeTakeOwnershipPrivilege 1424 wmic.exe Token: SeLoadDriverPrivilege 1424 wmic.exe Token: SeSystemProfilePrivilege 1424 wmic.exe Token: SeSystemtimePrivilege 1424 wmic.exe Token: SeProfSingleProcessPrivilege 1424 wmic.exe Token: SeIncBasePriorityPrivilege 1424 wmic.exe Token: SeCreatePagefilePrivilege 1424 wmic.exe Token: SeBackupPrivilege 1424 wmic.exe Token: SeRestorePrivilege 1424 wmic.exe Token: SeShutdownPrivilege 1424 wmic.exe Token: SeDebugPrivilege 1424 wmic.exe Token: SeSystemEnvironmentPrivilege 1424 wmic.exe Token: SeRemoteShutdownPrivilege 1424 wmic.exe Token: SeUndockPrivilege 1424 wmic.exe Token: SeManageVolumePrivilege 1424 wmic.exe Token: 33 1424 wmic.exe Token: 34 1424 wmic.exe Token: 35 1424 wmic.exe Token: 36 1424 wmic.exe Token: SeIncreaseQuotaPrivilege 1424 wmic.exe Token: SeSecurityPrivilege 1424 wmic.exe Token: SeTakeOwnershipPrivilege 1424 wmic.exe Token: SeLoadDriverPrivilege 1424 wmic.exe Token: SeSystemProfilePrivilege 1424 wmic.exe Token: SeSystemtimePrivilege 1424 wmic.exe Token: SeProfSingleProcessPrivilege 1424 wmic.exe Token: SeIncBasePriorityPrivilege 1424 wmic.exe Token: SeCreatePagefilePrivilege 1424 wmic.exe Token: SeBackupPrivilege 1424 wmic.exe Token: SeRestorePrivilege 1424 wmic.exe Token: SeShutdownPrivilege 1424 wmic.exe Token: SeDebugPrivilege 1424 wmic.exe Token: SeSystemEnvironmentPrivilege 1424 wmic.exe Token: SeRemoteShutdownPrivilege 1424 wmic.exe Token: SeUndockPrivilege 1424 wmic.exe Token: SeManageVolumePrivilege 1424 wmic.exe Token: 33 1424 wmic.exe Token: 34 1424 wmic.exe Token: 35 1424 wmic.exe Token: 36 1424 wmic.exe Token: SeBackupPrivilege 1380 vssvc.exe Token: SeRestorePrivilege 1380 vssvc.exe Token: SeAuditPrivilege 1380 vssvc.exe Token: SeIncreaseQuotaPrivilege 3996 wmic.exe Token: SeSecurityPrivilege 3996 wmic.exe Token: SeTakeOwnershipPrivilege 3996 wmic.exe Token: SeLoadDriverPrivilege 3996 wmic.exe Token: SeSystemProfilePrivilege 3996 wmic.exe Token: SeSystemtimePrivilege 3996 wmic.exe Token: SeProfSingleProcessPrivilege 3996 wmic.exe Token: SeIncBasePriorityPrivilege 3996 wmic.exe Token: SeCreatePagefilePrivilege 3996 wmic.exe Token: SeBackupPrivilege 3996 wmic.exe Token: SeRestorePrivilege 3996 wmic.exe Token: SeShutdownPrivilege 3996 wmic.exe Token: SeDebugPrivilege 3996 wmic.exe Token: SeSystemEnvironmentPrivilege 3996 wmic.exe Token: SeRemoteShutdownPrivilege 3996 wmic.exe Token: SeUndockPrivilege 3996 wmic.exe Token: SeManageVolumePrivilege 3996 wmic.exe Token: 33 3996 wmic.exe Token: 34 3996 wmic.exe Token: 35 3996 wmic.exe Token: 36 3996 wmic.exe Token: SeIncreaseQuotaPrivilege 3996 wmic.exe Token: SeSecurityPrivilege 3996 wmic.exe Token: SeTakeOwnershipPrivilege 3996 wmic.exe Token: SeLoadDriverPrivilege 3996 wmic.exe Token: SeSystemProfilePrivilege 3996 wmic.exe Token: SeSystemtimePrivilege 3996 wmic.exe Token: SeProfSingleProcessPrivilege 3996 wmic.exe Token: SeIncBasePriorityPrivilege 3996 wmic.exe Token: SeCreatePagefilePrivilege 3996 wmic.exe Token: SeBackupPrivilege 3996 wmic.exe Token: SeRestorePrivilege 3996 wmic.exe Token: SeShutdownPrivilege 3996 wmic.exe Token: SeDebugPrivilege 3996 wmic.exe Token: SeSystemEnvironmentPrivilege 3996 wmic.exe Token: SeRemoteShutdownPrivilege 3996 wmic.exe Token: SeUndockPrivilege 3996 wmic.exe Token: SeManageVolumePrivilege 3996 wmic.exe Token: 33 3996 wmic.exe Token: 34 3996 wmic.exe Token: 35 3996 wmic.exe Token: 36 3996 wmic.exe Token: 33 504 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 504 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription pid Process procid_target PID 648 wrote to memory of 1424 648 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 78 PID 648 wrote to memory of 1424 648 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 78 PID 648 wrote to memory of 3996 648 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 83 PID 648 wrote to memory of 3996 648 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\system32\wbem\wmic.exe"C:\qdao\pb\..\..\Windows\km\fto\kbdsk\..\..\..\system32\tslc\nd\ftb\..\..\..\wbem\ovn\axwbv\s\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\system32\wbem\wmic.exe"C:\r\kg\j\..\..\..\Windows\mmit\n\d\..\..\..\system32\hdn\..\wbem\ot\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f41⤵PID:504