Analysis
-
max time kernel
168s -
max time network
183s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 23:08
Static task
static1
Behavioral task
behavioral1
Sample
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe
Resource
win7-en-20211208
General
-
Target
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe
-
Size
1.1MB
-
MD5
8f6cff7e69cd66e3972f916c2d3c36cb
-
SHA1
83ccdc63d41a142702d6180db78b32b1cb7340f2
-
SHA256
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd
-
SHA512
5a9a115efe04b3637aa26089aa9d121bc907ae646c98e40b57d9900d195005197545368e5cdd4a706667aafb52799f47317872ae2557fbc076feed6a8b6e86d4
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc829e8d6ca
https://mazedecrypt.top/6d570cc829e8d6ca
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exedescription ioc process File renamed C:\Users\Admin\Pictures\CompareCopy.tiff => C:\Users\Admin\Pictures\CompareCopy.tiff.tbDAN 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Users\Admin\Pictures\OpenAssert.tiff 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File renamed C:\Users\Admin\Pictures\OpenAssert.tiff => C:\Users\Admin\Pictures\OpenAssert.tiff.8zUyWS 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Users\Admin\Pictures\CompareCopy.tiff 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe -
Drops startup file 2 IoCs
Processes:
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d570cc829e8d6ca.tmp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe -
Drops file in Program Files directory 23 IoCs
Processes:
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exedescription ioc process File opened for modification C:\Program Files\BackupLimit.001 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\CompressRegister.3gp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\DebugShow.iso 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\EditRestart.php 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\GroupRename.vstm 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\NewReset.wax 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\ResolveAdd.m4a 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File created C:\Program Files\DECRYPT-FILES.txt 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files (x86)\6d570cc829e8d6ca.tmp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6d570cc829e8d6ca.tmp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\TestAssert.scf 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\ExpandCopy.emz 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\ConfirmMount.mp4 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\ResetResolve.wdp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\6d570cc829e8d6ca.tmp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\StopEnable.rmi 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6d570cc829e8d6ca.tmp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6d570cc829e8d6ca.tmp 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe File opened for modification C:\Program Files\FindCopy.M2TS 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exepid process 1660 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
vssvc.exewmic.exedescription pid process Token: SeBackupPrivilege 772 vssvc.exe Token: SeRestorePrivilege 772 vssvc.exe Token: SeAuditPrivilege 772 vssvc.exe Token: SeIncreaseQuotaPrivilege 1704 wmic.exe Token: SeSecurityPrivilege 1704 wmic.exe Token: SeTakeOwnershipPrivilege 1704 wmic.exe Token: SeLoadDriverPrivilege 1704 wmic.exe Token: SeSystemProfilePrivilege 1704 wmic.exe Token: SeSystemtimePrivilege 1704 wmic.exe Token: SeProfSingleProcessPrivilege 1704 wmic.exe Token: SeIncBasePriorityPrivilege 1704 wmic.exe Token: SeCreatePagefilePrivilege 1704 wmic.exe Token: SeBackupPrivilege 1704 wmic.exe Token: SeRestorePrivilege 1704 wmic.exe Token: SeShutdownPrivilege 1704 wmic.exe Token: SeDebugPrivilege 1704 wmic.exe Token: SeSystemEnvironmentPrivilege 1704 wmic.exe Token: SeRemoteShutdownPrivilege 1704 wmic.exe Token: SeUndockPrivilege 1704 wmic.exe Token: SeManageVolumePrivilege 1704 wmic.exe Token: 33 1704 wmic.exe Token: 34 1704 wmic.exe Token: 35 1704 wmic.exe Token: SeIncreaseQuotaPrivilege 1704 wmic.exe Token: SeSecurityPrivilege 1704 wmic.exe Token: SeTakeOwnershipPrivilege 1704 wmic.exe Token: SeLoadDriverPrivilege 1704 wmic.exe Token: SeSystemProfilePrivilege 1704 wmic.exe Token: SeSystemtimePrivilege 1704 wmic.exe Token: SeProfSingleProcessPrivilege 1704 wmic.exe Token: SeIncBasePriorityPrivilege 1704 wmic.exe Token: SeCreatePagefilePrivilege 1704 wmic.exe Token: SeBackupPrivilege 1704 wmic.exe Token: SeRestorePrivilege 1704 wmic.exe Token: SeShutdownPrivilege 1704 wmic.exe Token: SeDebugPrivilege 1704 wmic.exe Token: SeSystemEnvironmentPrivilege 1704 wmic.exe Token: SeRemoteShutdownPrivilege 1704 wmic.exe Token: SeUndockPrivilege 1704 wmic.exe Token: SeManageVolumePrivilege 1704 wmic.exe Token: 33 1704 wmic.exe Token: 34 1704 wmic.exe Token: 35 1704 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exedescription pid process target process PID 1660 wrote to memory of 1704 1660 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe wmic.exe PID 1660 wrote to memory of 1704 1660 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe wmic.exe PID 1660 wrote to memory of 1704 1660 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe wmic.exe PID 1660 wrote to memory of 1704 1660 20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe"C:\Users\Admin\AppData\Local\Temp\20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\wmic.exe"C:\wc\l\up\..\..\..\Windows\hss\vim\wp\..\..\..\system32\e\..\wbem\ug\njh\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1660-54-0x000000000060E000-0x000000000068B000-memory.dmpFilesize
500KB
-
memory/1660-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1660-56-0x000000000060E000-0x000000000068B000-memory.dmpFilesize
500KB
-
memory/1660-57-0x0000000000050000-0x00000000000AE000-memory.dmpFilesize
376KB
-
memory/1660-61-0x0000000000051000-0x000000000008A000-memory.dmpFilesize
228KB