Analysis
-
max time kernel
166s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 23:08
Static task
static1
Behavioral task
behavioral1
Sample
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe
Resource
win10v2004-en-20220113
General
-
Target
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe
-
Size
365KB
-
MD5
ef95c48e750c1a3b1af8f5446fa04f54
-
SHA1
8ea5950ffefa2b7193a40682513e80a28d743175
-
SHA256
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0
-
SHA512
5d661b17bdfbbf40e5ead0cab9666ec94095d527d3d0c4b758670a00606f018867dc12d72cbf8e651db9c9f21849a88fe4666dff967bf436dfff8b2a574bc298
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c8c199081
https://mazedecrypt.top/8802099c8c199081
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops file in Program Files directory 36 IoCs
Processes:
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exedescription ioc process File opened for modification C:\Program Files\ClearUnlock.ico 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\SearchUndo.csv 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ShowSelect.xltm 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\WriteResume.vbs 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\HideRemove.vb 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\MergeComplete.i64 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\RepairDisconnect.ADTS 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files (x86)\8802099c8c199081.tmp 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\8802099c8c199081.tmp 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\DenyGrant.cab 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\DismountDebug.mov 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ExportConfirm.mpe 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\GroupAdd.rmi 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\RestartRemove.tiff 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File created C:\Program Files\DECRYPT-FILES.txt 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ApproveRestart.potm 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\AssertMeasure.m3u 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\MeasureRename.vbs 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\OptimizePing.dotx 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\RevokeUnprotect.mpeg3 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\StepExit.mht 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\CheckpointGet.iso 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ClearInvoke.vssx 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\CompareEdit.mp4v 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\CompareRevoke.xml 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ExportConfirm.odt 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ProtectMount.png 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ConvertEnter.dxf 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\CopyUnlock.mp4 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\DisconnectWatch.docx 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\MergeConvert.TS 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\UnregisterImport.xla 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\ImportStep.mpeg2 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\NewSplit.ico 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe File opened for modification C:\Program Files\StartRename.xlt 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe -
Drops file in Windows directory 7 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exepid process 2532 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe 2532 22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
svchost.exevssvc.exeTiWorker.exedescription pid process Token: SeShutdownPrivilege 1720 svchost.exe Token: SeCreatePagefilePrivilege 1720 svchost.exe Token: SeShutdownPrivilege 1720 svchost.exe Token: SeCreatePagefilePrivilege 1720 svchost.exe Token: SeShutdownPrivilege 1720 svchost.exe Token: SeCreatePagefilePrivilege 1720 svchost.exe Token: SeBackupPrivilege 3556 vssvc.exe Token: SeRestorePrivilege 3556 vssvc.exe Token: SeAuditPrivilege 3556 vssvc.exe Token: SeSecurityPrivilege 4976 TiWorker.exe Token: SeRestorePrivilege 4976 TiWorker.exe Token: SeBackupPrivilege 4976 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe"C:\Users\Admin\AppData\Local\Temp\22ccc6a9a8834e08f190486524fb86b177f332b5835f4bd75f31b4b667271bb0.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken