Resubmissions
30-11-2021 09:58
211130-lzqt4sefbn 1030-11-2021 09:26
211130-lejkaseehq 1020-10-2021 09:26
211020-leeakshgem 10Analysis
-
max time kernel
1561s -
max time network
1565s -
platform
windows11_x64 -
resource
win11 -
submitted
30-11-2021 09:26
Static task
static1
Behavioral task
behavioral1
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win11
General
-
Target
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d230cc5e2296c18
https://mazedecrypt.top/6d230cc5e2296c18
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6d230cc5e2296c18.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d230cc5e2296c18.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\6d230cc5e2296c18.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\6d230cc5e2296c18.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3480 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 3480 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 3880 vssvc.exe Token: SeRestorePrivilege 3880 vssvc.exe Token: SeAuditPrivilege 3880 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:888
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3880