Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-12-2020 09:45
Static task
static1
Behavioral task
behavioral1
Sample
zprxqb.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zprxqb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
zprxqb.exe
-
Size
473KB
-
MD5
f83fb9ce6a83da58b20685c1d7e1e546
-
SHA1
01c459b549c1c2a68208d38d4ba5e36d29212a4f
-
SHA256
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
-
SHA512
934ec9073a28b90e8df785bef49f224789da59f83729208b92dba0503e2894b3f48ed04b20de1ba49374b1cd26f0c87e8e5ab79e817258135e3be2c171f3f396
Score
10/10
Malware Config
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html zprxqb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iwvqck2.dat zprxqb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" zprxqb.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1908 zprxqb.exe -
Suspicious use of AdjustPrivilegeToken 83 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1092 wmic.exe Token: SeSecurityPrivilege 1092 wmic.exe Token: SeTakeOwnershipPrivilege 1092 wmic.exe Token: SeLoadDriverPrivilege 1092 wmic.exe Token: SeSystemProfilePrivilege 1092 wmic.exe Token: SeSystemtimePrivilege 1092 wmic.exe Token: SeProfSingleProcessPrivilege 1092 wmic.exe Token: SeIncBasePriorityPrivilege 1092 wmic.exe Token: SeCreatePagefilePrivilege 1092 wmic.exe Token: SeBackupPrivilege 1092 wmic.exe Token: SeRestorePrivilege 1092 wmic.exe Token: SeShutdownPrivilege 1092 wmic.exe Token: SeDebugPrivilege 1092 wmic.exe Token: SeSystemEnvironmentPrivilege 1092 wmic.exe Token: SeRemoteShutdownPrivilege 1092 wmic.exe Token: SeUndockPrivilege 1092 wmic.exe Token: SeManageVolumePrivilege 1092 wmic.exe Token: 33 1092 wmic.exe Token: 34 1092 wmic.exe Token: 35 1092 wmic.exe Token: SeIncreaseQuotaPrivilege 1092 wmic.exe Token: SeSecurityPrivilege 1092 wmic.exe Token: SeTakeOwnershipPrivilege 1092 wmic.exe Token: SeLoadDriverPrivilege 1092 wmic.exe Token: SeSystemProfilePrivilege 1092 wmic.exe Token: SeSystemtimePrivilege 1092 wmic.exe Token: SeProfSingleProcessPrivilege 1092 wmic.exe Token: SeIncBasePriorityPrivilege 1092 wmic.exe Token: SeCreatePagefilePrivilege 1092 wmic.exe Token: SeBackupPrivilege 1092 wmic.exe Token: SeRestorePrivilege 1092 wmic.exe Token: SeShutdownPrivilege 1092 wmic.exe Token: SeDebugPrivilege 1092 wmic.exe Token: SeSystemEnvironmentPrivilege 1092 wmic.exe Token: SeRemoteShutdownPrivilege 1092 wmic.exe Token: SeUndockPrivilege 1092 wmic.exe Token: SeManageVolumePrivilege 1092 wmic.exe Token: 33 1092 wmic.exe Token: 34 1092 wmic.exe Token: 35 1092 wmic.exe Token: SeBackupPrivilege 920 vssvc.exe Token: SeRestorePrivilege 920 vssvc.exe Token: SeAuditPrivilege 920 vssvc.exe Token: SeIncreaseQuotaPrivilege 676 wmic.exe Token: SeSecurityPrivilege 676 wmic.exe Token: SeTakeOwnershipPrivilege 676 wmic.exe Token: SeLoadDriverPrivilege 676 wmic.exe Token: SeSystemProfilePrivilege 676 wmic.exe Token: SeSystemtimePrivilege 676 wmic.exe Token: SeProfSingleProcessPrivilege 676 wmic.exe Token: SeIncBasePriorityPrivilege 676 wmic.exe Token: SeCreatePagefilePrivilege 676 wmic.exe Token: SeBackupPrivilege 676 wmic.exe Token: SeRestorePrivilege 676 wmic.exe Token: SeShutdownPrivilege 676 wmic.exe Token: SeDebugPrivilege 676 wmic.exe Token: SeSystemEnvironmentPrivilege 676 wmic.exe Token: SeRemoteShutdownPrivilege 676 wmic.exe Token: SeUndockPrivilege 676 wmic.exe Token: SeManageVolumePrivilege 676 wmic.exe Token: 33 676 wmic.exe Token: 34 676 wmic.exe Token: 35 676 wmic.exe Token: SeIncreaseQuotaPrivilege 676 wmic.exe Token: SeSecurityPrivilege 676 wmic.exe Token: SeTakeOwnershipPrivilege 676 wmic.exe Token: SeLoadDriverPrivilege 676 wmic.exe Token: SeSystemProfilePrivilege 676 wmic.exe Token: SeSystemtimePrivilege 676 wmic.exe Token: SeProfSingleProcessPrivilege 676 wmic.exe Token: SeIncBasePriorityPrivilege 676 wmic.exe Token: SeCreatePagefilePrivilege 676 wmic.exe Token: SeBackupPrivilege 676 wmic.exe Token: SeRestorePrivilege 676 wmic.exe Token: SeShutdownPrivilege 676 wmic.exe Token: SeDebugPrivilege 676 wmic.exe Token: SeSystemEnvironmentPrivilege 676 wmic.exe Token: SeRemoteShutdownPrivilege 676 wmic.exe Token: SeUndockPrivilege 676 wmic.exe Token: SeManageVolumePrivilege 676 wmic.exe Token: 33 676 wmic.exe Token: 34 676 wmic.exe Token: 35 676 wmic.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1092 1908 zprxqb.exe 29 PID 1908 wrote to memory of 1092 1908 zprxqb.exe 29 PID 1908 wrote to memory of 1092 1908 zprxqb.exe 29 PID 1908 wrote to memory of 1092 1908 zprxqb.exe 29 PID 1908 wrote to memory of 676 1908 zprxqb.exe 34 PID 1908 wrote to memory of 676 1908 zprxqb.exe 34 PID 1908 wrote to memory of 676 1908 zprxqb.exe 34 PID 1908 wrote to memory of 676 1908 zprxqb.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\zprxqb.exe"C:\Users\Admin\AppData\Local\Temp\zprxqb.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\wbem\wmic.exe"C:\duki\yqu\y\..\..\..\Windows\mkjv\ex\..\..\system32\fkv\gkq\..\..\wbem\eqvfm\udoyt\ihuae\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Windows\system32\wbem\wmic.exe"C:\quju\uuqvi\..\..\Windows\rwr\..\system32\oip\..\wbem\qks\q\lxne\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:920
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1632