Extracted

• • Target

    b53415f6_lcvDB3iF4J

  • Size

    7.4MB

  • MD5

    b53415f6d38ce4831cbf327daf5201b4

  • SHA1

    778d6f976e10d201903c76adcd18f14e685a3704

  • SHA256

    4efcc256493c1c7d8f695bee676beab4aaf3d3d1e1847cf8462c38af1107b7b8

  • SHA512

    0c2e2fd8ebfe175dc844d64ad9e85f8ab23f8e63b75d7773a38bf68741071c0ea6aa91402b1ab5813a7d66b289650b1e868c56dd86636dcc26c37c07bdb55bb4

  Score

  10^/10

  mazediscoveryevasionexploitransomwarethemidatrojan

  • Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Possible privilege escalation attempt

    exploit

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2