Analysis
-
max time kernel
161s -
max time network
182s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:41
Static task
static1
Behavioral task
behavioral1
Sample
be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe
Resource
win10v2004-en-20220113
General
-
Target
be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe
-
Size
704KB
-
MD5
19b4618578d7c17d52737dd99218e670
-
SHA1
62eb42aa419ff51412f2260482a7803542fe5390
-
SHA256
be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b
-
SHA512
591d6de41fb9a39d4f8f16746287ae52fbc476fe53d7e282954651fc383caf47d606864af07afbf4058524c540c762b6fb8b296d3297ac47dbefb08b7d5c403a
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5b457dc49
https://mazedecrypt.top/6c610cc5b457dc49
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\UnblockWait.png => C:\Users\Admin\Pictures\UnblockWait.png.ekNqVHo be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File renamed C:\Users\Admin\Pictures\ConfirmCompress.png => C:\Users\Admin\Pictures\ConfirmCompress.png.z0ciGk be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Users\Admin\Pictures\GrantRemove.tiff be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File renamed C:\Users\Admin\Pictures\GrantRemove.tiff => C:\Users\Admin\Pictures\GrantRemove.tiff.q9ev80 be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File renamed C:\Users\Admin\Pictures\MeasureUnregister.png => C:\Users\Admin\Pictures\MeasureUnregister.png.1ziCERI be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc5b457dc49.tmp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 41 IoCs
description ioc Process File opened for modification C:\Program Files\DisableRemove.au be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\DisconnectProtect.reg be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\FormatBackup.lock be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\PopDisable.mp3 be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\PublishResolve.mp4v be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\RenameComplete.jpeg be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File created C:\Program Files\DECRYPT-FILES.txt be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\CopyBackup.DVR be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\WriteStop.xlsm be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files (x86)\6c610cc5b457dc49.tmp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\AddOpen.bin be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\JoinFind.midi be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\ResetReceive.docx be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\SubmitDeny.vbs be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc5b457dc49.tmp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc5b457dc49.tmp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\6c610cc5b457dc49.tmp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\EnableCheckpoint.xhtml be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\InitializeAssert.mhtml be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\MeasureConvert.vssx be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\RestartRead.m1v be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\UnprotectSend.js be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\DisableConvertTo.scf be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\FindEdit.vdw be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\TestClear.mpv2 be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc5b457dc49.tmp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\AssertRestart.svgz be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\DisableSuspend.odp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\MountEdit.mp2v be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\PopDeny.mp2 be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\ReadSubmit.ppsm be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\ResolveNew.dot be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\CloseRegister.tmp be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\PopPush.avi be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\SelectApprove.M2V be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\SuspendUndo.vsdx be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe File opened for modification C:\Program Files\WriteMove.xltx be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1620 be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 620 vssvc.exe Token: SeRestorePrivilege 620 vssvc.exe Token: SeAuditPrivilege 620 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe"C:\Users\Admin\AppData\Local\Temp\be15c80ff19aa41daab5e811eb5daabf6eb01471ae915e0642bf04f481a7f55b.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:620