Analysis
-
max time kernel
170s -
max time network
186s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 23:12
Static task
static1
Behavioral task
behavioral1
Sample
0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe
Resource
win10v2004-en-20220112
General
-
Target
0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe
-
Size
363KB
-
MD5
b02be7a336dcc6635172e0d6ec24c554
-
SHA1
a58b45f6ac4c4fbcf938de01ee1e585fe3715fd6
-
SHA256
0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f
-
SHA512
406cb5422aa0d6af2a4fc9a129a82a8665b986cc4605e593808526e88ed008565d5a8dec7830b813f8f4d3140a4fd0842619e96950625ca5423d48b08e7f685d
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc571ecaeff
https://mazedecrypt.top/6c610cc571ecaeff
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 2 IoCs
Processes:
0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc571ecaeff.tmp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 35 IoCs
Processes:
0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exedescription ioc Process File opened for modification C:\Program Files\ConnectDebug.m1v 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\ResumeRepair.dot 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\SkipConfirm.svg 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files (x86)\6c610cc571ecaeff.tmp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc571ecaeff.tmp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc571ecaeff.tmp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\BackupDismount.odp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\InitializeApprove.3g2 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\RestartSplit.mpeg 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\StopGrant.mp4 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\ConnectDebug.pub 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\WaitUnlock.ogg 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\SaveOpen.vbe 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\PingSubmit.midi 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\ResetConvertTo.ps1xml 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\SkipFind.mp4 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\UninstallDismount.tif 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc571ecaeff.tmp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\EnterFind.vsdx 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\DebugRegister.WTV 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\6c610cc571ecaeff.tmp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\ConvertFind.gif 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\NewRestore.docm 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\CompressUnblock.xlsx 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\NewUnlock.vssx 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\RestoreBlock.ps1xml 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File created C:\Program Files\DECRYPT-FILES.txt 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\RemoveEnable.M2TS 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\RepairComplete.mpp 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\SyncConvert.mov 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe File opened for modification C:\Program Files\GetResume.wmf 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exepid Process 1632 0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid Process Token: SeBackupPrivilege 1628 vssvc.exe Token: SeRestorePrivilege 1628 vssvc.exe Token: SeAuditPrivilege 1628 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe"C:\Users\Admin\AppData\Local\Temp\0f1cbf09b19fc9963742e3f60def1434fa86ac760790fb974a6b5fcd81b4881f.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1632
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628