Analysis
-
max time kernel
157s -
max time network
171s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:36
Static task
static1
Behavioral task
behavioral1
Sample
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe
Resource
win7-en-20211208
General
-
Target
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe
-
Size
1.1MB
-
MD5
814c507bf10fc9698a1890563e206e41
-
SHA1
a19a29b67574e38b3eb7b680f57bf6010c07fc80
-
SHA256
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57
-
SHA512
83139e9483f1fc4f6fc48c0dc7f425430cfa7245887051b44284d914a3fcdd679e02559da90bc7b71a0a4c6e91a797313190095be9552e1da528d403ffcd23fc
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc577e72ca6
https://mazedecrypt.top/6c610cc577e72ca6
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exedescription ioc Process File renamed C:\Users\Admin\Pictures\BlockSkip.crw => C:\Users\Admin\Pictures\BlockSkip.crw.hhN9z de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\BlockSync.png => C:\Users\Admin\Pictures\BlockSync.png.hhN9z de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\ExpandUnlock.crw => C:\Users\Admin\Pictures\ExpandUnlock.crw.WKUfF de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\MountLimit.png => C:\Users\Admin\Pictures\MountLimit.png.kOSyDR de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\TestConfirm.tif => C:\Users\Admin\Pictures\TestConfirm.tif.9wlcEGi de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\UnprotectSubmit.crw => C:\Users\Admin\Pictures\UnprotectSubmit.crw.a00ACcZ de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Users\Admin\Pictures\GrantReceive.tiff de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\GrantReceive.tiff => C:\Users\Admin\Pictures\GrantReceive.tiff.kOSyDR de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\SetExit.crw => C:\Users\Admin\Pictures\SetExit.crw.9wlcEGi de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File renamed C:\Users\Admin\Pictures\UpdateUninstall.tif => C:\Users\Admin\Pictures\UpdateUninstall.tif.a00ACcZ de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe -
Drops startup file 2 IoCs
Processes:
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc577e72ca6.tmp de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 39 IoCs
Processes:
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exedescription ioc Process File opened for modification C:\Program Files\ApproveRestore.dot de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\RepairUnpublish.M2TS de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files (x86)\6c610cc577e72ca6.tmp de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc577e72ca6.tmp de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\DenyGroup.php de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\ReadConnect.m4v de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\ResetUninstall.tiff de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\SendCompress.AAC de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File created C:\Program Files\DECRYPT-FILES.txt de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\DisconnectRequest.vbs de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\GrantStop.dot de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\RegisterConnect.vdw de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\RemoveWatch.odt de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc577e72ca6.tmp de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\6c610cc577e72ca6.tmp de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\ReceiveWatch.aifc de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\StopExport.zip de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\UndoUnblock.001 de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\BackupMerge.iso de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\ConvertFromCompress.lock de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\InstallClose.au3 de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\PopRepair.m1v de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc577e72ca6.tmp de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\RestoreResume.wma de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\UnblockClear.3g2 de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\ExportBackup.ps1 de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\GrantDisable.AAC de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\InvokeClear.M2T de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\MergeUninstall.wdp de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\PingSkip.ppsx de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\PushRemove.pot de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\LimitRevoke.kix de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\OpenRemove.m3u de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\OutEdit.emf de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe File opened for modification C:\Program Files\RequestGrant.html de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exepid Process 1684 de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid Process Token: SeBackupPrivilege 1664 vssvc.exe Token: SeRestorePrivilege 1664 vssvc.exe Token: SeAuditPrivilege 1664 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe"C:\Users\Admin\AppData\Local\Temp\de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664