Analysis
-
max time kernel
131s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:32
Static task
static1
Behavioral task
behavioral1
Sample
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe
Resource
win10v2004-en-20220113
General
-
Target
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe
-
Size
1.1MB
-
MD5
108a298b4ed5b4e77541061f32e55751
-
SHA1
6ab4f716180cc48855d65f77d4bdbd3d709a2f19
-
SHA256
f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d
-
SHA512
ffb83a1042fe51776d0eb6db18bf269d4379963215b9508db8f0a7ad6897dbd86fb392daba542d6de4d85ab00a2a29c0557c7b28bb1d5434750bfbc49c9d0455
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8f54bd94e
https://mazedecrypt.top/6d570cc8f54bd94e
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 16 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\BackupResolve.png => C:\Users\Admin\Pictures\BackupResolve.png.lSdrq f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\CompleteRestart.tiff => C:\Users\Admin\Pictures\CompleteRestart.tiff.lSdrq f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Users\Admin\Pictures\WatchSet.tiff f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\WatchSet.tiff => C:\Users\Admin\Pictures\WatchSet.tiff.f13HEnv f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\InstallConvertTo.raw => C:\Users\Admin\Pictures\InstallConvertTo.raw.Ttmlx f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\JoinDeny.crw => C:\Users\Admin\Pictures\JoinDeny.crw.Ttmlx f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\MeasureStep.raw => C:\Users\Admin\Pictures\MeasureStep.raw.Ttmlx f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\ResolveExit.tiff => C:\Users\Admin\Pictures\ResolveExit.tiff.x5TszU f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Users\Admin\Pictures\StopSet.tiff f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\StopSet.tiff => C:\Users\Admin\Pictures\StopSet.tiff.IbsQDK f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Users\Admin\Pictures\UnlockCheckpoint.tiff f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\UnlockCheckpoint.tiff => C:\Users\Admin\Pictures\UnlockCheckpoint.tiff.IbsQDK f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Users\Admin\Pictures\CompleteRestart.tiff f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Users\Admin\Pictures\PushRemove.tiff f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File renamed C:\Users\Admin\Pictures\PushRemove.tiff => C:\Users\Admin\Pictures\PushRemove.tiff.Ttmlx f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Users\Admin\Pictures\ResolveExit.tiff f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d570cc8f54bd94e.tmp f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\111.bmp" f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe -
Drops file in Program Files directory 46 IoCs
description ioc Process File opened for modification C:\Program Files\PushUse.jfif f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\SendConnect.midi f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\UndoSync.mht f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\UnprotectJoin.MOD f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6d570cc8f54bd94e.tmp f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\ConvertToMerge.ram f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\EnterInvoke.m1v f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\ExitSubmit.AAC f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\WaitLimit.mpeg2 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\AssertUpdate.fon f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\LockProtect.mp3 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\OpenInstall.xla f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\SuspendSend.vb f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\UnblockBlock.vstm f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6d570cc8f54bd94e.tmp f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\AssertInvoke.vdw f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\ResumeSend.crw f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\RevokeSet.m3u f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\StopCheckpoint.pcx f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\TestApprove.asf f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\TestLimit.pptx f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\ApproveRead.vssm f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\PushStart.mp4 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\SkipConnect.php f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File created C:\Program Files\DECRYPT-FILES.txt f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\ConnectMove.ppsm f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\PublishDisable.lock f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\ResumeGet.emz f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\SetEnable.snd f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\StepProtect.ps1 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\TestUse.svgz f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\6d570cc8f54bd94e.tmp f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\ProtectUninstall.otf f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\RepairEdit.xlsb f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\SearchUnregister.M2V f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files (x86)\6d570cc8f54bd94e.tmp f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\EnterRedo.M2V f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\JoinRemove.hta f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\RestoreInstall.fon f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\EnterStart.dot f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files\FindImport.AAC f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6d570cc8f54bd94e.tmp f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1592 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeBackupPrivilege 964 vssvc.exe Token: SeRestorePrivilege 964 vssvc.exe Token: SeAuditPrivilege 964 vssvc.exe Token: SeIncreaseQuotaPrivilege 1760 wmic.exe Token: SeSecurityPrivilege 1760 wmic.exe Token: SeTakeOwnershipPrivilege 1760 wmic.exe Token: SeLoadDriverPrivilege 1760 wmic.exe Token: SeSystemProfilePrivilege 1760 wmic.exe Token: SeSystemtimePrivilege 1760 wmic.exe Token: SeProfSingleProcessPrivilege 1760 wmic.exe Token: SeIncBasePriorityPrivilege 1760 wmic.exe Token: SeCreatePagefilePrivilege 1760 wmic.exe Token: SeBackupPrivilege 1760 wmic.exe Token: SeRestorePrivilege 1760 wmic.exe Token: SeShutdownPrivilege 1760 wmic.exe Token: SeDebugPrivilege 1760 wmic.exe Token: SeSystemEnvironmentPrivilege 1760 wmic.exe Token: SeRemoteShutdownPrivilege 1760 wmic.exe Token: SeUndockPrivilege 1760 wmic.exe Token: SeManageVolumePrivilege 1760 wmic.exe Token: 33 1760 wmic.exe Token: 34 1760 wmic.exe Token: 35 1760 wmic.exe Token: SeIncreaseQuotaPrivilege 1760 wmic.exe Token: SeSecurityPrivilege 1760 wmic.exe Token: SeTakeOwnershipPrivilege 1760 wmic.exe Token: SeLoadDriverPrivilege 1760 wmic.exe Token: SeSystemProfilePrivilege 1760 wmic.exe Token: SeSystemtimePrivilege 1760 wmic.exe Token: SeProfSingleProcessPrivilege 1760 wmic.exe Token: SeIncBasePriorityPrivilege 1760 wmic.exe Token: SeCreatePagefilePrivilege 1760 wmic.exe Token: SeBackupPrivilege 1760 wmic.exe Token: SeRestorePrivilege 1760 wmic.exe Token: SeShutdownPrivilege 1760 wmic.exe Token: SeDebugPrivilege 1760 wmic.exe Token: SeSystemEnvironmentPrivilege 1760 wmic.exe Token: SeRemoteShutdownPrivilege 1760 wmic.exe Token: SeUndockPrivilege 1760 wmic.exe Token: SeManageVolumePrivilege 1760 wmic.exe Token: 33 1760 wmic.exe Token: 34 1760 wmic.exe Token: 35 1760 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1592 wrote to memory of 1760 1592 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe 31 PID 1592 wrote to memory of 1760 1592 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe 31 PID 1592 wrote to memory of 1760 1592 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe 31 PID 1592 wrote to memory of 1760 1592 f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe"C:\Users\Admin\AppData\Local\Temp\f65722a5c638266b43258c6787eb69ccd8d94e149d68444f8194f448f232da0d.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\system32\wbem\wmic.exe"C:\bxvfx\..\Windows\bnc\gojp\..\..\system32\gmhl\pyq\..\..\wbem\u\ik\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:964
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1980