Analysis
-
max time kernel
141s -
max time network
190s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:58
Static task
static1
Behavioral task
behavioral1
Sample
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe
Resource
win7v20210408
General
-
Target
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe
-
Size
364KB
-
MD5
b93616a1ea4f4a131cc0507e6c789f94
-
SHA1
0b97455143e682e818fc4a9b615f57349dc84894
-
SHA256
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d
-
SHA512
e6b8e4009ee946514c0a177838b1094b70fe84d8e4511e8ab9bca4180b0bf4cc5bf2ef563fb7efabd6cc91d758ed2e910f501081a72aaa9581d17ece780b70ad
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d050cd0bf5a78ff
https://mazedecrypt.top/6d050cd0bf5a78ff
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exedescription ioc Process File renamed C:\Users\Admin\Pictures\PingGet.tif => C:\Users\Admin\Pictures\PingGet.tif.J6VG1aQ 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File renamed C:\Users\Admin\Pictures\StartSend.png => C:\Users\Admin\Pictures\StartSend.png.bn04p2w 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Users\Admin\Pictures\TraceMove.tiff 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File renamed C:\Users\Admin\Pictures\TraceMove.tiff => C:\Users\Admin\Pictures\TraceMove.tiff.bn04p2w 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File renamed C:\Users\Admin\Pictures\LimitUnregister.png => C:\Users\Admin\Pictures\LimitUnregister.png.J6VG1aQ 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe -
Drops startup file 2 IoCs
Processes:
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d050cd0bf5a78ff.tmp 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe -
Drops file in Program Files directory 46 IoCs
Processes:
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exedescription ioc Process File opened for modification C:\Program Files\SuspendWatch.asf 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\ConnectEnable.zip 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\GroupBackup.tiff 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\MergeRename.mid 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\RequestOut.wm 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files (x86)\6d050cd0bf5a78ff.tmp 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\RedoDismount.vssm 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\RepairAdd.png 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\UpdateTrace.xltm 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\WaitFind.mov 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\SplitJoin.pptm 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\6d050cd0bf5a78ff.tmp 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\FormatUnprotect.pdf 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\GroupDeny.wax 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\RepairReceive.raw 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\MeasureExpand.vsd 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\PublishSet.pub 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\RenameAssert.htm 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\StopResolve.vsd 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\AssertRepair.asx 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\DisconnectOptimize.vdw 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\EditResolve.xps 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\UnblockTest.mpe 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6d050cd0bf5a78ff.tmp 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File created C:\Program Files\DECRYPT-FILES.txt 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\SaveRename.dxf 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\SearchResize.7z 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\LimitClose.wpl 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\RestartClear.avi 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\SelectUnblock.cab 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\UninstallNew.ttc 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\BackupConvert.wmv 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\ConvertToEnable.asx 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\DismountCopy.dxf 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\InitializeSuspend.mhtml 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\WriteUnregister.emf 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6d050cd0bf5a78ff.tmp 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6d050cd0bf5a78ff.tmp 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\CompressResize.raw 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\ImportInitialize.pot 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\RestartShow.xlsx 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe File opened for modification C:\Program Files\ResumeFind.aifc 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exepid Process 1708 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
vssvc.exewmic.exeAUDIODG.EXEdescription pid Process Token: SeBackupPrivilege 1132 vssvc.exe Token: SeRestorePrivilege 1132 vssvc.exe Token: SeAuditPrivilege 1132 vssvc.exe Token: SeIncreaseQuotaPrivilege 1652 wmic.exe Token: SeSecurityPrivilege 1652 wmic.exe Token: SeTakeOwnershipPrivilege 1652 wmic.exe Token: SeLoadDriverPrivilege 1652 wmic.exe Token: SeSystemProfilePrivilege 1652 wmic.exe Token: SeSystemtimePrivilege 1652 wmic.exe Token: SeProfSingleProcessPrivilege 1652 wmic.exe Token: SeIncBasePriorityPrivilege 1652 wmic.exe Token: SeCreatePagefilePrivilege 1652 wmic.exe Token: SeBackupPrivilege 1652 wmic.exe Token: SeRestorePrivilege 1652 wmic.exe Token: SeShutdownPrivilege 1652 wmic.exe Token: SeDebugPrivilege 1652 wmic.exe Token: SeSystemEnvironmentPrivilege 1652 wmic.exe Token: SeRemoteShutdownPrivilege 1652 wmic.exe Token: SeUndockPrivilege 1652 wmic.exe Token: SeManageVolumePrivilege 1652 wmic.exe Token: 33 1652 wmic.exe Token: 34 1652 wmic.exe Token: 35 1652 wmic.exe Token: SeIncreaseQuotaPrivilege 1652 wmic.exe Token: SeSecurityPrivilege 1652 wmic.exe Token: SeTakeOwnershipPrivilege 1652 wmic.exe Token: SeLoadDriverPrivilege 1652 wmic.exe Token: SeSystemProfilePrivilege 1652 wmic.exe Token: SeSystemtimePrivilege 1652 wmic.exe Token: SeProfSingleProcessPrivilege 1652 wmic.exe Token: SeIncBasePriorityPrivilege 1652 wmic.exe Token: SeCreatePagefilePrivilege 1652 wmic.exe Token: SeBackupPrivilege 1652 wmic.exe Token: SeRestorePrivilege 1652 wmic.exe Token: SeShutdownPrivilege 1652 wmic.exe Token: SeDebugPrivilege 1652 wmic.exe Token: SeSystemEnvironmentPrivilege 1652 wmic.exe Token: SeRemoteShutdownPrivilege 1652 wmic.exe Token: SeUndockPrivilege 1652 wmic.exe Token: SeManageVolumePrivilege 1652 wmic.exe Token: 33 1652 wmic.exe Token: 34 1652 wmic.exe Token: 35 1652 wmic.exe Token: 33 824 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 824 AUDIODG.EXE Token: 33 824 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 824 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exedescription pid Process procid_target PID 1708 wrote to memory of 1652 1708 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe 35 PID 1708 wrote to memory of 1652 1708 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe 35 PID 1708 wrote to memory of 1652 1708 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe 35 PID 1708 wrote to memory of 1652 1708 2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe"C:\Users\Admin\AppData\Local\Temp\2a6c602769ac15bd837f9ff390acc443d023ee62f76e1be8236dd2dd957eef3d.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\wbem\wmic.exe"C:\st\..\Windows\abmhw\rgmg\gf\..\..\..\system32\vmjm\jffcu\..\..\wbem\ga\q\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:704
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5901⤵
- Suspicious use of AdjustPrivilegeToken
PID:824