Resubmissions
30-11-2021 09:58
211130-lzqt4sefbn 1030-11-2021 09:26
211130-lejkaseehq 1020-10-2021 09:26
211020-leeakshgem 10Analysis
-
max time kernel
1625s -
max time network
1565s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
30-11-2021 09:26
Static task
static1
Behavioral task
behavioral1
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win11
General
-
Target
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c230cc23b17cfe2
https://mazedecrypt.top/6c230cc23b17cfe2
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exedescription ioc process File renamed C:\Users\Admin\Pictures\ResumeConvertFrom.tif => C:\Users\Admin\Pictures\ResumeConvertFrom.tif.fXLN4 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\Pictures\CompressJoin.tiff 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\CompressJoin.tiff => C:\Users\Admin\Pictures\CompressJoin.tiff.CqId 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\ExpandUnpublish.raw => C:\Users\Admin\Pictures\ExpandUnpublish.raw.aW6J 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\MeasureRedo.raw => C:\Users\Admin\Pictures\MeasureRedo.raw.wlwPP 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\RepairExit.crw => C:\Users\Admin\Pictures\RepairExit.crw.fXLN4 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops startup file 4 IoCs
Processes:
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c230cc23b17cfe2.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6c230cc23b17cfe2.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops file in Program Files directory 26 IoCs
Processes:
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exedescription ioc process File opened for modification C:\Program Files\SwitchOptimize.ex_ 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SyncComplete.jpe 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\6c230cc23b17cfe2.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ConnectMeasure.aifc 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ConnectUninstall.rtf 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\HideDismount.css 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\LockBackup.htm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\OptimizeUse.cab 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\BlockFormat.zip 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ConvertFromTest.bat 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\DisconnectRegister.emz 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\OutUse.cmd 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SplitInitialize.mp4v 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SwitchMeasure.DVR 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ApproveProtect.mpp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ClearLimit.jpe 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\HideCopy.3g2 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RestoreReset.xla 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SelectSync.3gp2 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SwitchWrite.rle 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\6c230cc23b17cfe2.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\GrantAdd.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SendDisconnect.dotm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\StepCompress.easmx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exepid process 2376 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 2376 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
vssvc.exewmic.exeAUDIODG.EXEAUDIODG.EXEAUDIODG.EXEAUDIODG.EXEdescription pid process Token: SeBackupPrivilege 4068 vssvc.exe Token: SeRestorePrivilege 4068 vssvc.exe Token: SeAuditPrivilege 4068 vssvc.exe Token: SeIncreaseQuotaPrivilege 1416 wmic.exe Token: SeSecurityPrivilege 1416 wmic.exe Token: SeTakeOwnershipPrivilege 1416 wmic.exe Token: SeLoadDriverPrivilege 1416 wmic.exe Token: SeSystemProfilePrivilege 1416 wmic.exe Token: SeSystemtimePrivilege 1416 wmic.exe Token: SeProfSingleProcessPrivilege 1416 wmic.exe Token: SeIncBasePriorityPrivilege 1416 wmic.exe Token: SeCreatePagefilePrivilege 1416 wmic.exe Token: SeBackupPrivilege 1416 wmic.exe Token: SeRestorePrivilege 1416 wmic.exe Token: SeShutdownPrivilege 1416 wmic.exe Token: SeDebugPrivilege 1416 wmic.exe Token: SeSystemEnvironmentPrivilege 1416 wmic.exe Token: SeRemoteShutdownPrivilege 1416 wmic.exe Token: SeUndockPrivilege 1416 wmic.exe Token: SeManageVolumePrivilege 1416 wmic.exe Token: 33 1416 wmic.exe Token: 34 1416 wmic.exe Token: 35 1416 wmic.exe Token: 36 1416 wmic.exe Token: SeIncreaseQuotaPrivilege 1416 wmic.exe Token: SeSecurityPrivilege 1416 wmic.exe Token: SeTakeOwnershipPrivilege 1416 wmic.exe Token: SeLoadDriverPrivilege 1416 wmic.exe Token: SeSystemProfilePrivilege 1416 wmic.exe Token: SeSystemtimePrivilege 1416 wmic.exe Token: SeProfSingleProcessPrivilege 1416 wmic.exe Token: SeIncBasePriorityPrivilege 1416 wmic.exe Token: SeCreatePagefilePrivilege 1416 wmic.exe Token: SeBackupPrivilege 1416 wmic.exe Token: SeRestorePrivilege 1416 wmic.exe Token: SeShutdownPrivilege 1416 wmic.exe Token: SeDebugPrivilege 1416 wmic.exe Token: SeSystemEnvironmentPrivilege 1416 wmic.exe Token: SeRemoteShutdownPrivilege 1416 wmic.exe Token: SeUndockPrivilege 1416 wmic.exe Token: SeManageVolumePrivilege 1416 wmic.exe Token: 33 1416 wmic.exe Token: 34 1416 wmic.exe Token: 35 1416 wmic.exe Token: 36 1416 wmic.exe Token: 33 2508 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2508 AUDIODG.EXE Token: 33 2968 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2968 AUDIODG.EXE Token: 33 1164 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1164 AUDIODG.EXE Token: 33 3448 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3448 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exedescription pid process target process PID 2376 wrote to memory of 1416 2376 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe wmic.exe PID 2376 wrote to memory of 1416 2376 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\wmic.exe"C:\x\wej\vdhgk\..\..\..\Windows\whk\nm\..\..\system32\g\..\wbem\hxseb\wm\pj\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4081⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3841⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-130-0x00000223C1540000-0x00000223C1542000-memory.dmpFilesize
8KB
-
memory/1164-132-0x00000223C1540000-0x00000223C1542000-memory.dmpFilesize
8KB
-
memory/1164-131-0x00000223C1540000-0x00000223C1542000-memory.dmpFilesize
8KB
-
memory/1416-123-0x0000000000000000-mapping.dmp
-
memory/2376-122-0x00000000004E0000-0x000000000053E000-memory.dmpFilesize
376KB
-
memory/2376-118-0x00000000004E0000-0x000000000053E000-memory.dmpFilesize
376KB
-
memory/2508-124-0x0000022313780000-0x0000022313782000-memory.dmpFilesize
8KB
-
memory/2508-126-0x0000022313780000-0x0000022313782000-memory.dmpFilesize
8KB
-
memory/2508-125-0x0000022313780000-0x0000022313782000-memory.dmpFilesize
8KB
-
memory/2968-127-0x00000297479F0000-0x00000297479F2000-memory.dmpFilesize
8KB
-
memory/2968-129-0x00000297479F0000-0x00000297479F2000-memory.dmpFilesize
8KB
-
memory/2968-128-0x00000297479F0000-0x00000297479F2000-memory.dmpFilesize
8KB
-
memory/3448-133-0x0000016B4ED20000-0x0000016B4ED22000-memory.dmpFilesize
8KB
-
memory/3448-134-0x0000016B4ED20000-0x0000016B4ED22000-memory.dmpFilesize
8KB