Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-12-2020 09:45
Static task
static1
Behavioral task
behavioral1
Sample
zprxqb.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
zprxqb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
zprxqb.exe
-
Size
473KB
-
MD5
f83fb9ce6a83da58b20685c1d7e1e546
-
SHA1
01c459b549c1c2a68208d38d4ba5e36d29212a4f
-
SHA256
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
-
SHA512
934ec9073a28b90e8df785bef49f224789da59f83729208b92dba0503e2894b3f48ed04b20de1ba49374b1cd26f0c87e8e5ab79e817258135e3be2c171f3f396
Score
10/10
Malware Config
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SwitchCompare.tif => C:\Users\Admin\Pictures\SwitchCompare.tif.vI7O zprxqb.exe File renamed C:\Users\Admin\Pictures\TraceImport.png => C:\Users\Admin\Pictures\TraceImport.png.vI7O zprxqb.exe File opened for modification C:\Users\Admin\Pictures\ApproveRedo.tiff zprxqb.exe File renamed C:\Users\Admin\Pictures\ApproveRedo.tiff => C:\Users\Admin\Pictures\ApproveRedo.tiff.uhEssHN zprxqb.exe File renamed C:\Users\Admin\Pictures\OutDismount.crw => C:\Users\Admin\Pictures\OutDismount.crw.pyhl zprxqb.exe File renamed C:\Users\Admin\Pictures\RevokeEdit.crw => C:\Users\Admin\Pictures\RevokeEdit.crw.pyhl zprxqb.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html zprxqb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c07st.dat zprxqb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html zprxqb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\c07st.dat zprxqb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" zprxqb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 540 zprxqb.exe 540 zprxqb.exe -
Suspicious use of AdjustPrivilegeToken 89 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2012 wmic.exe Token: SeSecurityPrivilege 2012 wmic.exe Token: SeTakeOwnershipPrivilege 2012 wmic.exe Token: SeLoadDriverPrivilege 2012 wmic.exe Token: SeSystemProfilePrivilege 2012 wmic.exe Token: SeSystemtimePrivilege 2012 wmic.exe Token: SeProfSingleProcessPrivilege 2012 wmic.exe Token: SeIncBasePriorityPrivilege 2012 wmic.exe Token: SeCreatePagefilePrivilege 2012 wmic.exe Token: SeBackupPrivilege 2012 wmic.exe Token: SeRestorePrivilege 2012 wmic.exe Token: SeShutdownPrivilege 2012 wmic.exe Token: SeDebugPrivilege 2012 wmic.exe Token: SeSystemEnvironmentPrivilege 2012 wmic.exe Token: SeRemoteShutdownPrivilege 2012 wmic.exe Token: SeUndockPrivilege 2012 wmic.exe Token: SeManageVolumePrivilege 2012 wmic.exe Token: 33 2012 wmic.exe Token: 34 2012 wmic.exe Token: 35 2012 wmic.exe Token: 36 2012 wmic.exe Token: SeIncreaseQuotaPrivilege 2012 wmic.exe Token: SeSecurityPrivilege 2012 wmic.exe Token: SeTakeOwnershipPrivilege 2012 wmic.exe Token: SeLoadDriverPrivilege 2012 wmic.exe Token: SeSystemProfilePrivilege 2012 wmic.exe Token: SeSystemtimePrivilege 2012 wmic.exe Token: SeProfSingleProcessPrivilege 2012 wmic.exe Token: SeIncBasePriorityPrivilege 2012 wmic.exe Token: SeCreatePagefilePrivilege 2012 wmic.exe Token: SeBackupPrivilege 2012 wmic.exe Token: SeRestorePrivilege 2012 wmic.exe Token: SeShutdownPrivilege 2012 wmic.exe Token: SeDebugPrivilege 2012 wmic.exe Token: SeSystemEnvironmentPrivilege 2012 wmic.exe Token: SeRemoteShutdownPrivilege 2012 wmic.exe Token: SeUndockPrivilege 2012 wmic.exe Token: SeManageVolumePrivilege 2012 wmic.exe Token: 33 2012 wmic.exe Token: 34 2012 wmic.exe Token: 35 2012 wmic.exe Token: 36 2012 wmic.exe Token: SeBackupPrivilege 1308 vssvc.exe Token: SeRestorePrivilege 1308 vssvc.exe Token: SeAuditPrivilege 1308 vssvc.exe Token: SeIncreaseQuotaPrivilege 756 wmic.exe Token: SeSecurityPrivilege 756 wmic.exe Token: SeTakeOwnershipPrivilege 756 wmic.exe Token: SeLoadDriverPrivilege 756 wmic.exe Token: SeSystemProfilePrivilege 756 wmic.exe Token: SeSystemtimePrivilege 756 wmic.exe Token: SeProfSingleProcessPrivilege 756 wmic.exe Token: SeIncBasePriorityPrivilege 756 wmic.exe Token: SeCreatePagefilePrivilege 756 wmic.exe Token: SeBackupPrivilege 756 wmic.exe Token: SeRestorePrivilege 756 wmic.exe Token: SeShutdownPrivilege 756 wmic.exe Token: SeDebugPrivilege 756 wmic.exe Token: SeSystemEnvironmentPrivilege 756 wmic.exe Token: SeRemoteShutdownPrivilege 756 wmic.exe Token: SeUndockPrivilege 756 wmic.exe Token: SeManageVolumePrivilege 756 wmic.exe Token: 33 756 wmic.exe Token: 34 756 wmic.exe Token: 35 756 wmic.exe Token: 36 756 wmic.exe Token: SeIncreaseQuotaPrivilege 756 wmic.exe Token: SeSecurityPrivilege 756 wmic.exe Token: SeTakeOwnershipPrivilege 756 wmic.exe Token: SeLoadDriverPrivilege 756 wmic.exe Token: SeSystemProfilePrivilege 756 wmic.exe Token: SeSystemtimePrivilege 756 wmic.exe Token: SeProfSingleProcessPrivilege 756 wmic.exe Token: SeIncBasePriorityPrivilege 756 wmic.exe Token: SeCreatePagefilePrivilege 756 wmic.exe Token: SeBackupPrivilege 756 wmic.exe Token: SeRestorePrivilege 756 wmic.exe Token: SeShutdownPrivilege 756 wmic.exe Token: SeDebugPrivilege 756 wmic.exe Token: SeSystemEnvironmentPrivilege 756 wmic.exe Token: SeRemoteShutdownPrivilege 756 wmic.exe Token: SeUndockPrivilege 756 wmic.exe Token: SeManageVolumePrivilege 756 wmic.exe Token: 33 756 wmic.exe Token: 34 756 wmic.exe Token: 35 756 wmic.exe Token: 36 756 wmic.exe Token: 33 2656 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2656 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 540 wrote to memory of 2012 540 zprxqb.exe 78 PID 540 wrote to memory of 2012 540 zprxqb.exe 78 PID 540 wrote to memory of 756 540 zprxqb.exe 83 PID 540 wrote to memory of 756 540 zprxqb.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\zprxqb.exe"C:\Users\Admin\AppData\Local\Temp\zprxqb.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\system32\wbem\wmic.exe"C:\ycg\k\..\..\Windows\msthk\umpip\gcngm\..\..\..\system32\ds\o\..\..\wbem\rrcx\qg\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\system32\wbem\wmic.exe"C:\ivy\vkray\..\..\Windows\cl\x\..\..\system32\yybw\..\wbem\ylqds\rqf\ux\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3441⤵PID:2656