Malware Analysis Report

2024-09-22 14:41

Sample ID 220216-21tkdsebc8
Target 4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9
SHA256 4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9
Tags
maze ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9

Threat Level: Known bad

The file 4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9 was found to be: Known bad.

Malicious Activity Summary

maze ransomware spyware stealer trojan

Maze

Deletes shadow copies

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

Drops file in Windows directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-02-16 23:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-16 23:03

Reported

2022-02-16 23:11

Platform

win7-en-20211208

Max time kernel

161s

Max time network

173s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe"

Signatures

Maze

trojan ransomware maze

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\MountRegister.tif => C:\Users\Admin\Pictures\MountRegister.tif.hvjU5 C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\CompressRestart.tif => C:\Users\Admin\Pictures\CompressRestart.tif.r4rk C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File opened for modification C:\Users\Admin\Pictures\DismountSubmit.tiff C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\MeasureSelect.raw => C:\Users\Admin\Pictures\MeasureSelect.raw.hvjU5 C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\DisconnectPop.tif => C:\Users\Admin\Pictures\DisconnectPop.tif.r4rk C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File opened for modification C:\Users\Admin\Pictures\InitializeRepair.tiff C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\ExpandRegister.png => C:\Users\Admin\Pictures\ExpandRegister.png.hvjU5 C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\ReadMount.tif => C:\Users\Admin\Pictures\ReadMount.tif.yfv546 C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\DismountSubmit.tiff => C:\Users\Admin\Pictures\DismountSubmit.tiff.r4rk C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\EnableSuspend.png => C:\Users\Admin\Pictures\EnableSuspend.png.hvjU5 C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\InitializeRepair.tiff => C:\Users\Admin\Pictures\InitializeRepair.tiff.hvjU5 C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\UnregisterMount.crw => C:\Users\Admin\Pictures\UnregisterMount.crw.Vsrafu C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\AssertInstall.tif => C:\Users\Admin\Pictures\AssertInstall.tif.dr8nDXb C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File renamed C:\Users\Admin\Pictures\DenyUnregister.raw => C:\Users\Admin\Pictures\DenyUnregister.raw.r4rk C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgcbr.dat C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe

"C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe"

C:\Windows\system32\wbem\wmic.exe

"C:\q\jrla\dm\..\..\..\Windows\y\mxi\kv\..\..\..\system32\h\k\sj\..\..\..\wbem\blk\if\ljuda\..\..\..\wmic.exe" shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
TR 92.63.8.47:80 tcp
TR 92.63.8.47:80 tcp
TR 92.63.8.47:80 tcp
PL 92.63.32.2:80 tcp
PL 92.63.32.2:80 tcp
PL 92.63.32.2:80 tcp
PL 92.63.37.100:80 tcp
PL 92.63.37.100:80 tcp

Files

memory/456-55-0x0000000076141000-0x0000000076143000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-16 23:03

Reported

2022-02-16 23:11

Platform

win10v2004-en-20220113

Max time kernel

174s

Max time network

183s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe"

Signatures

Maze

trojan ransomware maze

Deletes shadow copies

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe

"C:\Users\Admin\AppData\Local\Temp\4674a5f259bdca4233d6e20c7797dd66db2a841be82dc9b73b71e04c51b546c9.exe"

C:\Windows\system32\wbem\wmic.exe

"C:\jui\akgxc\f\..\..\..\Windows\ijkl\t\re\..\..\..\system32\caupr\jggti\wgf\..\..\..\wbem\dm\..\wmic.exe" shadowcopy delete

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

Network

Country Destination Domain Proto
TR 92.63.8.47:80 tcp
TR 92.63.8.47:80 tcp
PL 92.63.32.2:80 tcp
PL 92.63.32.2:80 tcp
PL 92.63.37.100:80 tcp
PL 92.63.37.100:80 tcp
RU 92.63.194.20:80 tcp
RU 92.63.194.20:80 tcp

Files

memory/1660-130-0x0000017FCB580000-0x0000017FCB590000-memory.dmp

memory/1660-131-0x0000017FCBC20000-0x0000017FCBC30000-memory.dmp

memory/1660-132-0x0000017FCE300000-0x0000017FCE304000-memory.dmp