Analysis
-
max time kernel
166s -
max time network
183s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 23:12
Static task
static1
Behavioral task
behavioral1
Sample
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe
Resource
win7-en-20211208
General
-
Target
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe
-
Size
1.0MB
-
MD5
be0e634d059c6d113b7874eb00daabbf
-
SHA1
4ba2a5d816f09e83b8b5dacb99bc26ee8ec0db46
-
SHA256
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd
-
SHA512
00bee8ab544be1643f894c2b1375a5b014eec4d85cfd5d630918e49fc815c332eddeec5f736719a40fbe0d28a49675851fccfff94a0353ac8c976ce2c3606be7
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8f79fbe35
https://mazedecrypt.top/6d570cc8f79fbe35
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exedescription ioc Process File renamed C:\Users\Admin\Pictures\CopySkip.png => C:\Users\Admin\Pictures\CopySkip.png.umIN 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File renamed C:\Users\Admin\Pictures\ExitExport.tif => C:\Users\Admin\Pictures\ExitExport.tif.umIN 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Users\Admin\Pictures\PopInitialize.tiff 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File renamed C:\Users\Admin\Pictures\PopInitialize.tiff => C:\Users\Admin\Pictures\PopInitialize.tiff.r7gg61l 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File renamed C:\Users\Admin\Pictures\RequestClear.tif => C:\Users\Admin\Pictures\RequestClear.tif.r7gg61l 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe -
Drops startup file 2 IoCs
Processes:
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d570cc8f79fbe35.tmp 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe -
Drops file in Program Files directory 47 IoCs
Processes:
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exedescription ioc Process File opened for modification C:\Program Files\StartCheckpoint.ps1 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\StopStep.M2TS 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\CompleteUse.vstx 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\DenyPush.wmx 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\RestartPop.ps1xml 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\ShowConnect.xla 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File created C:\Program Files\DECRYPT-FILES.txt 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\MergeShow.csv 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\SkipBlock.htm 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\UndoPush.pot 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\AddGrant.svg 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\OutDismount.mpeg3 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\WriteMerge.cmd 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\HideProtect.3g2 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\RenameUnpublish.m4v 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\ConvertSwitch.sql 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\DisableUndo.jtx 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\FindSubmit.7z 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\GrantExpand.ppsx 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\RestartRedo.vb 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\UpdateResume.rm 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files (x86)\6d570cc8f79fbe35.tmp 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6d570cc8f79fbe35.tmp 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\MountDismount.wdp 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\ProtectUnlock.reg 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\ReceiveRead.docx 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\RedoTest.rar 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\DebugUpdate.bin 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\EnableRead.rle 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\ResetDeny.m4v 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6d570cc8f79fbe35.tmp 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6d570cc8f79fbe35.tmp 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\DebugDisable.ttc 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\MoveCompress.rar 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\StopSend.wm 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\WatchHide.ocx 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\RemoveRepair.xla 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\SetRead.dxf 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\UnregisterResume.otf 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\6d570cc8f79fbe35.tmp 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\ConvertFromUnregister.xltm 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\EnterRename.ppt 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe File opened for modification C:\Program Files\PushHide.ADT 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exepid Process 1560 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
vssvc.exeAUDIODG.EXEdescription pid Process Token: SeBackupPrivilege 1632 vssvc.exe Token: SeRestorePrivilege 1632 vssvc.exe Token: SeAuditPrivilege 1632 vssvc.exe Token: 33 800 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 800 AUDIODG.EXE Token: 33 800 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 800 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exedescription pid Process procid_target PID 1560 wrote to memory of 1436 1560 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe 35 PID 1560 wrote to memory of 1436 1560 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe 35 PID 1560 wrote to memory of 1436 1560 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe 35 PID 1560 wrote to memory of 1436 1560 0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe"C:\Users\Admin\AppData\Local\Temp\0e03b75972bc00a096a75f4eb6b2245dc23731ed683fcc48d9ed4045069aa0fd.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\system32\wbem\wmic.exe"C:\ve\..\Windows\olrc\q\fxc\..\..\..\system32\biksd\g\pbc\..\..\..\wbem\bedit\s\hma\..\..\..\wmic.exe" shadowcopy delete2⤵PID:1436
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1068
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x54c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:800