Analysis
-
max time kernel
144s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:36
Static task
static1
Behavioral task
behavioral1
Sample
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe
Resource
win10v2004-en-20220113
General
-
Target
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe
-
Size
1.1MB
-
MD5
996360cdddfe5f6d6b868177fe5a3e1d
-
SHA1
35bff002183a579b816f99178150421671e53483
-
SHA256
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2
-
SHA512
983b93496ac27dd1d479fd991b568ff176aa0b3de170781d45e6e8db408253373597c9b78cc2547f460646863fa687c351222312f8858241ad1cf027f26da994
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc591536de
https://mazedecrypt.top/6c610cc591536de
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 2 IoCs
Processes:
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc591536de.tmp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 35 IoCs
Processes:
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exedescription ioc Process File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc591536de.tmp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\StopImport.xla db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\DismountSync.tif db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\LockConnect.WTV db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\ReceivePing.DVR-MS db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\ShowUse.bat db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\SplitUnpublish.eprtx db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\DisableComplete.snd db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\LockClose.snd db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files (x86)\6c610cc591536de.tmp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\DebugCompress.001 db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\CompareUndo.ico db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\FindAssert.i64 db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\StopAssert.inf db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\SubmitOut.aif db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\6c610cc591536de.tmp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\ReceiveConvertTo.mov db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\DenySend.ttc db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\ReadStop.xls db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc591536de.tmp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\AddResolve.i64 db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\RestoreUndo.vstx db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\SwitchRevoke.cfg db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\SyncImport.pcx db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File created C:\Program Files\DECRYPT-FILES.txt db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\ConvertFromCompare.AAC db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\InvokeConnect.tmp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\SubmitTest.asp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\UnlockRepair.au3 db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc591536de.tmp db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe File opened for modification C:\Program Files\BackupConnect.mpeg db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exepid Process 1652 db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid Process Token: SeBackupPrivilege 1380 vssvc.exe Token: SeRestorePrivilege 1380 vssvc.exe Token: SeAuditPrivilege 1380 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe"C:\Users\Admin\AppData\Local\Temp\db617d3ca09f78673aef2a706a0161b9a7e160f58891f14a1e7250b39e3d9fb2.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380