Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:41
Static task
static1
Behavioral task
behavioral1
Sample
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe
Resource
win7v20210408
General
-
Target
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe
-
Size
365KB
-
MD5
be537a66d01c67076c8491b05866c894
-
SHA1
8614c5aa7abe3b91ffbc5637dd53bdff886aa1c1
-
SHA256
877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1
-
SHA512
b0581690fe78b0d5c1b934b2364065b1a373d89e1bbe9f68a94cf60203e9ae79d5b7708507cc0e7057fd51f8cf7ab2e012b46fa041cf80d4d967d09bb2c2e81d
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88dc09a47fb8b9ef
https://mazedecrypt.top/88dc09a47fb8b9ef
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\MergeApprove.tiff 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\MergeApprove.tiff => C:\Users\Admin\Pictures\MergeApprove.tiff.emtWTT 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\PopShow.crw => C:\Users\Admin\Pictures\PopShow.crw.emtWTT 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\RevokeEdit.crw => C:\Users\Admin\Pictures\RevokeEdit.crw.yLbOVah 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Users\Admin\Pictures\WatchPing.tiff 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\AddGroup.png => C:\Users\Admin\Pictures\AddGroup.png.BiSt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\BackupTrace.tif => C:\Users\Admin\Pictures\BackupTrace.tif.qulB 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\ConfirmSet.tif => C:\Users\Admin\Pictures\ConfirmSet.tif.qulB 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\WatchPing.tiff => C:\Users\Admin\Pictures\WatchPing.tiff.yLbOVah 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectBackup.crw => C:\Users\Admin\Pictures\UnprotectBackup.crw.yLbOVah 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\88dc09a47fb8b9ef.tmp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe -
Drops file in Program Files directory 35 IoCs
description ioc Process File opened for modification C:\Program Files\CloseCompare.xps 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\WaitOptimize.mpg 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\BackupLock.mht 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files (x86)\88dc09a47fb8b9ef.tmp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\88dc09a47fb8b9ef.tmp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File created C:\Program Files\DECRYPT-FILES.txt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\ResizeRestart.pcx 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\SuspendUndo.MTS 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\UnlockOut.mpp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\OpenSend.ps1 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\88dc09a47fb8b9ef.tmp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\StartExpand.lock 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\UnblockImport.css 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\UpdateLock.nfo 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\CompressOut.cab 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\ExpandExport.txt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\PingRename.html 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\ResumeConvert.m1v 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\RemoveUnregister.pcx 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\SwitchGrant.ppt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\88dc09a47fb8b9ef.tmp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\EnableRedo.easmx 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\FindExpand.mpeg 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\RemoveJoin.m1v 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\CopyReceive.docm 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\StopRestore.tif 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\UnblockRevoke.docx 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\88dc09a47fb8b9ef.tmp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\ExpandUnprotect.cab 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\OptimizeCopy.emz 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File opened for modification C:\Program Files\SetUnblock.odp 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 748 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeBackupPrivilege 1196 vssvc.exe Token: SeRestorePrivilege 1196 vssvc.exe Token: SeAuditPrivilege 1196 vssvc.exe Token: SeIncreaseQuotaPrivilege 1652 wmic.exe Token: SeSecurityPrivilege 1652 wmic.exe Token: SeTakeOwnershipPrivilege 1652 wmic.exe Token: SeLoadDriverPrivilege 1652 wmic.exe Token: SeSystemProfilePrivilege 1652 wmic.exe Token: SeSystemtimePrivilege 1652 wmic.exe Token: SeProfSingleProcessPrivilege 1652 wmic.exe Token: SeIncBasePriorityPrivilege 1652 wmic.exe Token: SeCreatePagefilePrivilege 1652 wmic.exe Token: SeBackupPrivilege 1652 wmic.exe Token: SeRestorePrivilege 1652 wmic.exe Token: SeShutdownPrivilege 1652 wmic.exe Token: SeDebugPrivilege 1652 wmic.exe Token: SeSystemEnvironmentPrivilege 1652 wmic.exe Token: SeRemoteShutdownPrivilege 1652 wmic.exe Token: SeUndockPrivilege 1652 wmic.exe Token: SeManageVolumePrivilege 1652 wmic.exe Token: 33 1652 wmic.exe Token: 34 1652 wmic.exe Token: 35 1652 wmic.exe Token: SeIncreaseQuotaPrivilege 1652 wmic.exe Token: SeSecurityPrivilege 1652 wmic.exe Token: SeTakeOwnershipPrivilege 1652 wmic.exe Token: SeLoadDriverPrivilege 1652 wmic.exe Token: SeSystemProfilePrivilege 1652 wmic.exe Token: SeSystemtimePrivilege 1652 wmic.exe Token: SeProfSingleProcessPrivilege 1652 wmic.exe Token: SeIncBasePriorityPrivilege 1652 wmic.exe Token: SeCreatePagefilePrivilege 1652 wmic.exe Token: SeBackupPrivilege 1652 wmic.exe Token: SeRestorePrivilege 1652 wmic.exe Token: SeShutdownPrivilege 1652 wmic.exe Token: SeDebugPrivilege 1652 wmic.exe Token: SeSystemEnvironmentPrivilege 1652 wmic.exe Token: SeRemoteShutdownPrivilege 1652 wmic.exe Token: SeUndockPrivilege 1652 wmic.exe Token: SeManageVolumePrivilege 1652 wmic.exe Token: 33 1652 wmic.exe Token: 34 1652 wmic.exe Token: 35 1652 wmic.exe Token: 33 1456 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1456 AUDIODG.EXE Token: 33 1456 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1456 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 748 wrote to memory of 1652 748 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe 35 PID 748 wrote to memory of 1652 748 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe 35 PID 748 wrote to memory of 1652 748 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe 35 PID 748 wrote to memory of 1652 748 877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe"C:\Users\Admin\AppData\Local\Temp\877c439da147bab8e2c32f03814e3973c22cbcd112d35bc2735b803ac9113da1.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\system32\wbem\wmic.exe"C:\j\gd\..\..\Windows\didwi\..\system32\bxns\..\wbem\b\t\jwk\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:940
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x57c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456