Overview
overview
10Static
static
2b3518937f...bf.dll
windows7_x64
102b3518937f...bf.dll
windows10_x64
104ea8b8c37c...97.dll
windows7_x64
104ea8b8c37c...97.dll
windows10_x64
107c1b18932f...73.dll
windows7_x64
107c1b18932f...73.dll
windows10_x64
10f3c3e2cbed...c8.dll
windows7_x64
10f3c3e2cbed...c8.dll
windows10_x64
10Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
08-11-2021 07:01
Static task
static1
Behavioral task
behavioral1
Sample
2b3518937fd231560c7dc4f5af672a033b1c810d7f2f82c8151c025ce75775bf.dll
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
2b3518937fd231560c7dc4f5af672a033b1c810d7f2f82c8151c025ce75775bf.dll
Resource
win10-en-20211104
Behavioral task
behavioral3
Sample
4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97.dll
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97.dll
Resource
win10-en-20211104
Behavioral task
behavioral5
Sample
7c1b18932f622126441802f5ccaa9eefb88465d83a4a527d2c7ca2bab404b373.dll
Resource
win7-en-20211014
Behavioral task
behavioral6
Sample
7c1b18932f622126441802f5ccaa9eefb88465d83a4a527d2c7ca2bab404b373.dll
Resource
win10-en-20211104
Behavioral task
behavioral7
Sample
f3c3e2cbedafd594b40efe12ae2a638489a7065dc2e1657524877fe0bd15d6c8.dll
Resource
win7-en-20211104
Behavioral task
behavioral8
Sample
f3c3e2cbedafd594b40efe12ae2a638489a7065dc2e1657524877fe0bd15d6c8.dll
Resource
win10-en-20211014
General
-
Target
4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97.dll
-
Size
486KB
-
MD5
c96df334b5ed70473ec6a58a545208b6
-
SHA1
f6ad7b0a1d93b7a70e286b87f423119daa4ea4df
-
SHA256
4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97
-
SHA512
acb8b936ae74b5e4bce6f854ab2cf6875bdd913965c21f3015241eecfd3991c9b7cc0810c9bdae883b3aff96595187936d65598cd6fa62abf19ab5e271737c40
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c850ccac5956c0e
https://mazedecrypt.top/6c850ccac5956c0e
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\PingMount.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\PingMount.tiff => C:\Users\Admin\Pictures\PingMount.tiff.64id7mY regsvr32.exe File renamed C:\Users\Admin\Pictures\SendInstall.png => C:\Users\Admin\Pictures\SendInstall.png.ScxEhuu regsvr32.exe File renamed C:\Users\Admin\Pictures\SendSkip.crw => C:\Users\Admin\Pictures\SendSkip.crw.ScxEhuu regsvr32.exe File renamed C:\Users\Admin\Pictures\WaitSkip.tif => C:\Users\Admin\Pictures\WaitSkip.tif.ScxEhuu regsvr32.exe File opened for modification C:\Users\Admin\Pictures\CheckpointClear.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\CheckpointClear.tiff => C:\Users\Admin\Pictures\CheckpointClear.tiff.3rcPF regsvr32.exe File renamed C:\Users\Admin\Pictures\InvokeDismount.crw => C:\Users\Admin\Pictures\InvokeDismount.crw.PeeN8Q regsvr32.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c850ccac5956c0e.tmp regsvr32.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\111.bmp" regsvr32.exe -
Drops file in Program Files directory 39 IoCs
description ioc Process File opened for modification C:\Program Files\EditUse.iso regsvr32.exe File opened for modification C:\Program Files\LockMount.css regsvr32.exe File opened for modification C:\Program Files\RenameApprove.docx regsvr32.exe File created C:\Program Files\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\DisableMeasure.snd regsvr32.exe File opened for modification C:\Program Files\DisconnectUninstall.tiff regsvr32.exe File opened for modification C:\Program Files\PublishExport.txt regsvr32.exe File opened for modification C:\Program Files\SwitchMount.contact regsvr32.exe File opened for modification C:\Program Files\UnlockConnect.ADT regsvr32.exe File opened for modification C:\Program Files (x86)\6c850ccac5956c0e.tmp regsvr32.exe File opened for modification C:\Program Files\ConvertToMeasure.snd regsvr32.exe File opened for modification C:\Program Files\CopyInstall.dwg regsvr32.exe File opened for modification C:\Program Files\LimitConfirm.mpa regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\6c850ccac5956c0e.tmp regsvr32.exe File opened for modification C:\Program Files\OpenSkip.bmp regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c850ccac5956c0e.tmp regsvr32.exe File opened for modification C:\Program Files\SuspendSave.rar regsvr32.exe File opened for modification C:\Program Files\ClearSearch.html regsvr32.exe File opened for modification C:\Program Files\ExportSwitch.rle regsvr32.exe File opened for modification C:\Program Files\StopRevoke.bmp regsvr32.exe File opened for modification C:\Program Files\AddUnprotect.scf regsvr32.exe File opened for modification C:\Program Files\EditSplit.pub regsvr32.exe File opened for modification C:\Program Files\SplitExport.mpeg3 regsvr32.exe File opened for modification C:\Program Files\PingMeasure.xlt regsvr32.exe File opened for modification C:\Program Files\SkipReceive.svgz regsvr32.exe File opened for modification C:\Program Files\UnblockUninstall.M2TS regsvr32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c850ccac5956c0e.tmp regsvr32.exe File opened for modification C:\Program Files\CheckpointUnlock.xlsx regsvr32.exe File opened for modification C:\Program Files\DisconnectEnter.ps1 regsvr32.exe File opened for modification C:\Program Files\MovePublish.dib regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c850ccac5956c0e.tmp regsvr32.exe File opened for modification C:\Program Files\ExportResolve.ps1xml regsvr32.exe File opened for modification C:\Program Files\FindEnable.ex_ regsvr32.exe File opened for modification C:\Program Files\UpdateApprove.temp regsvr32.exe File opened for modification C:\Program Files\MergeDisconnect.css regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 764 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeBackupPrivilege 1200 vssvc.exe Token: SeRestorePrivilege 1200 vssvc.exe Token: SeAuditPrivilege 1200 vssvc.exe Token: SeIncreaseQuotaPrivilege 1468 wmic.exe Token: SeSecurityPrivilege 1468 wmic.exe Token: SeTakeOwnershipPrivilege 1468 wmic.exe Token: SeLoadDriverPrivilege 1468 wmic.exe Token: SeSystemProfilePrivilege 1468 wmic.exe Token: SeSystemtimePrivilege 1468 wmic.exe Token: SeProfSingleProcessPrivilege 1468 wmic.exe Token: SeIncBasePriorityPrivilege 1468 wmic.exe Token: SeCreatePagefilePrivilege 1468 wmic.exe Token: SeBackupPrivilege 1468 wmic.exe Token: SeRestorePrivilege 1468 wmic.exe Token: SeShutdownPrivilege 1468 wmic.exe Token: SeDebugPrivilege 1468 wmic.exe Token: SeSystemEnvironmentPrivilege 1468 wmic.exe Token: SeRemoteShutdownPrivilege 1468 wmic.exe Token: SeUndockPrivilege 1468 wmic.exe Token: SeManageVolumePrivilege 1468 wmic.exe Token: 33 1468 wmic.exe Token: 34 1468 wmic.exe Token: 35 1468 wmic.exe Token: SeIncreaseQuotaPrivilege 1468 wmic.exe Token: SeSecurityPrivilege 1468 wmic.exe Token: SeTakeOwnershipPrivilege 1468 wmic.exe Token: SeLoadDriverPrivilege 1468 wmic.exe Token: SeSystemProfilePrivilege 1468 wmic.exe Token: SeSystemtimePrivilege 1468 wmic.exe Token: SeProfSingleProcessPrivilege 1468 wmic.exe Token: SeIncBasePriorityPrivilege 1468 wmic.exe Token: SeCreatePagefilePrivilege 1468 wmic.exe Token: SeBackupPrivilege 1468 wmic.exe Token: SeRestorePrivilege 1468 wmic.exe Token: SeShutdownPrivilege 1468 wmic.exe Token: SeDebugPrivilege 1468 wmic.exe Token: SeSystemEnvironmentPrivilege 1468 wmic.exe Token: SeRemoteShutdownPrivilege 1468 wmic.exe Token: SeUndockPrivilege 1468 wmic.exe Token: SeManageVolumePrivilege 1468 wmic.exe Token: 33 1468 wmic.exe Token: 34 1468 wmic.exe Token: 35 1468 wmic.exe Token: 33 588 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 588 AUDIODG.EXE Token: 33 588 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 588 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1256 wrote to memory of 764 1256 regsvr32.exe 28 PID 1256 wrote to memory of 764 1256 regsvr32.exe 28 PID 1256 wrote to memory of 764 1256 regsvr32.exe 28 PID 1256 wrote to memory of 764 1256 regsvr32.exe 28 PID 1256 wrote to memory of 764 1256 regsvr32.exe 28 PID 1256 wrote to memory of 764 1256 regsvr32.exe 28 PID 1256 wrote to memory of 764 1256 regsvr32.exe 28 PID 764 wrote to memory of 1468 764 regsvr32.exe 33 PID 764 wrote to memory of 1468 764 regsvr32.exe 33 PID 764 wrote to memory of 1468 764 regsvr32.exe 33 PID 764 wrote to memory of 1468 764 regsvr32.exe 33
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97.dll2⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\system32\wbem\wmic.exe"C:\s\nxj\l\..\..\..\Windows\a\..\system32\hf\..\wbem\sn\ngemh\geeh\..\..\..\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1800
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4501⤵
- Suspicious use of AdjustPrivilegeToken
PID:588