Analysis
-
max time kernel
164s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:40
Static task
static1
Behavioral task
behavioral1
Sample
bedebbe588a683a1c2eb09d4fa24d1c1ec53ae2715de3656bb96b31aa4f4d85d.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
bedebbe588a683a1c2eb09d4fa24d1c1ec53ae2715de3656bb96b31aa4f4d85d.dll
Resource
win10v2004-en-20220112
General
-
Target
bedebbe588a683a1c2eb09d4fa24d1c1ec53ae2715de3656bb96b31aa4f4d85d.dll
-
Size
594KB
-
MD5
775bff988c806a1334f2c1b40e861a9b
-
SHA1
6a223a2870f2b5540b63c61af2f6a186d3160677
-
SHA256
bedebbe588a683a1c2eb09d4fa24d1c1ec53ae2715de3656bb96b31aa4f4d85d
-
SHA512
3dd7a95306ed9bc74a2062785fd684176fc044a5a52fc322e46459ee9ab05f80d21d2deb4f166b48a3024b053472a637d763016a2ec344750d84cb582e2f96fe
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5d87bc7c4
https://mazedecrypt.top/6c610cc5d87bc7c4
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc5d87bc7c4.tmp regsvr32.exe -
Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files\AddExit.htm regsvr32.exe File opened for modification C:\Program Files\ConvertFind.wav regsvr32.exe File opened for modification C:\Program Files\SwitchGet.raw regsvr32.exe File opened for modification C:\Program Files\UnregisterLimit.png regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt regsvr32.exe File created C:\Program Files\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\6c610cc5d87bc7c4.tmp regsvr32.exe File opened for modification C:\Program Files\UseSplit.ps1 regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc5d87bc7c4.tmp regsvr32.exe File opened for modification C:\Program Files\GetClear.ex_ regsvr32.exe File opened for modification C:\Program Files\ProtectSelect.php regsvr32.exe File opened for modification C:\Program Files\SubmitRestart.mp4 regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc5d87bc7c4.tmp regsvr32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\CloseSave.xps regsvr32.exe File opened for modification C:\Program Files\InitializeAdd.ex_ regsvr32.exe File opened for modification C:\Program Files\MeasureUpdate.potx regsvr32.exe File opened for modification C:\Program Files\PopSend.wpl regsvr32.exe File opened for modification C:\Program Files\SetCompare.aif regsvr32.exe File opened for modification C:\Program Files\SkipConfirm.potx regsvr32.exe File opened for modification C:\Program Files\UnprotectWrite.cab regsvr32.exe File opened for modification C:\Program Files (x86)\6c610cc5d87bc7c4.tmp regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc5d87bc7c4.tmp regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 820 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 960 vssvc.exe Token: SeRestorePrivilege 960 vssvc.exe Token: SeAuditPrivilege 960 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1264 wrote to memory of 820 1264 regsvr32.exe 27 PID 1264 wrote to memory of 820 1264 regsvr32.exe 27 PID 1264 wrote to memory of 820 1264 regsvr32.exe 27 PID 1264 wrote to memory of 820 1264 regsvr32.exe 27 PID 1264 wrote to memory of 820 1264 regsvr32.exe 27 PID 1264 wrote to memory of 820 1264 regsvr32.exe 27 PID 1264 wrote to memory of 820 1264 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bedebbe588a683a1c2eb09d4fa24d1c1ec53ae2715de3656bb96b31aa4f4d85d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\bedebbe588a683a1c2eb09d4fa24d1c1ec53ae2715de3656bb96b31aa4f4d85d.dll2⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:820
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:960