Analysis
-
max time kernel
151s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 22:33
Static task
static1
Behavioral task
behavioral1
Sample
eb2e7e5e491cfa8744e16dfdb9ff5f4270d6ef63432ea2d1ade0fb54487ef33b.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
eb2e7e5e491cfa8744e16dfdb9ff5f4270d6ef63432ea2d1ade0fb54487ef33b.dll
Resource
win10v2004-en-20220113
General
-
Target
eb2e7e5e491cfa8744e16dfdb9ff5f4270d6ef63432ea2d1ade0fb54487ef33b.dll
-
Size
368KB
-
MD5
388ad7944ffdd2e87a3b7cd178d65c86
-
SHA1
1407d7b934d900318a4cff58989d6534e6fcbe4a
-
SHA256
eb2e7e5e491cfa8744e16dfdb9ff5f4270d6ef63432ea2d1ade0fb54487ef33b
-
SHA512
824730e346f385404ca448eb7fe56fdf64d6645bfd6130c55867d340545ee84e4fe4f4db5ea0247a28e91298f6b3fa2ff47f9228462cb81154bc2c6a3ee301bc
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8d3b50c4b
https://mazedecrypt.top/6c2b0cc8d3b50c4b
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops file in Program Files directory 31 IoCs
description ioc Process File opened for modification C:\Program Files\ClearMove.au3 rundll32.exe File opened for modification C:\Program Files\DisconnectFormat.aiff rundll32.exe File opened for modification C:\Program Files\PublishCompress.ppsx rundll32.exe File opened for modification C:\Program Files\RegisterUnpublish.mht rundll32.exe File opened for modification C:\Program Files\StartRename.vssx rundll32.exe File opened for modification C:\Program Files\ApproveRevoke.vstm rundll32.exe File opened for modification C:\Program Files\EnterResume.3gp2 rundll32.exe File opened for modification C:\Program Files\ExportEnter.tiff rundll32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files\CompareConvertTo.3gpp rundll32.exe File opened for modification C:\Program Files\ImportEnter.dib rundll32.exe File opened for modification C:\Program Files\MoveRename.jpeg rundll32.exe File opened for modification C:\Program Files\OpenTest.vst rundll32.exe File created C:\Program Files\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files\6c2b0cc8d3b50c4b.tmp rundll32.exe File opened for modification C:\Program Files\ExportRequest.csv rundll32.exe File opened for modification C:\Program Files\InvokeAdd.pub rundll32.exe File opened for modification C:\Program Files\EnterRedo.sql rundll32.exe File opened for modification C:\Program Files\GrantLimit.php rundll32.exe File opened for modification C:\Program Files\RevokeRequest.jfif rundll32.exe File opened for modification C:\Program Files\UnpublishTrace.mpa rundll32.exe File opened for modification C:\Program Files\ExpandUpdate.pub rundll32.exe File opened for modification C:\Program Files\GroupMove.mid rundll32.exe File opened for modification C:\Program Files\MountAssert.vb rundll32.exe File opened for modification C:\Program Files\SplitDisconnect.ico rundll32.exe File opened for modification C:\Program Files (x86)\6c2b0cc8d3b50c4b.tmp rundll32.exe File opened for modification C:\Program Files\ConfirmFind.docx rundll32.exe File opened for modification C:\Program Files\EnterPush.gif rundll32.exe File opened for modification C:\Program Files\JoinConnect.css rundll32.exe File opened for modification C:\Program Files\MoveEnable.m3u rundll32.exe File opened for modification C:\Program Files\UnblockProtect.vsd rundll32.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1696 rundll32.exe 1696 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2008 vssvc.exe Token: SeRestorePrivilege 2008 vssvc.exe Token: SeAuditPrivilege 2008 vssvc.exe Token: SeShutdownPrivilege 3100 svchost.exe Token: SeCreatePagefilePrivilege 3100 svchost.exe Token: SeShutdownPrivilege 3100 svchost.exe Token: SeCreatePagefilePrivilege 3100 svchost.exe Token: SeShutdownPrivilege 3100 svchost.exe Token: SeCreatePagefilePrivilege 3100 svchost.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe Token: SeRestorePrivilege 3616 TiWorker.exe Token: SeSecurityPrivilege 3616 TiWorker.exe Token: SeBackupPrivilege 3616 TiWorker.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1336 wrote to memory of 1696 1336 rundll32.exe 81 PID 1336 wrote to memory of 1696 1336 rundll32.exe 81 PID 1336 wrote to memory of 1696 1336 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb2e7e5e491cfa8744e16dfdb9ff5f4270d6ef63432ea2d1ade0fb54487ef33b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb2e7e5e491cfa8744e16dfdb9ff5f4270d6ef63432ea2d1ade0fb54487ef33b.dll,#12⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3616