Analysis
-
max time kernel
156s -
max time network
173s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:41
Static task
static1
Behavioral task
behavioral1
Sample
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe
Resource
win10v2004-en-20220113
General
-
Target
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe
-
Size
363KB
-
MD5
f83cef2bf33a4d43e58b771e81af3ecc
-
SHA1
12133b783cef924cbc2911deb11cba148d97dad4
-
SHA256
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015
-
SHA512
0d0ed1846d8cf5cba89c1eaa952110b420b4ef0684f4b4c00bd7db47e5d6f72639a90e3725520b5502dbfe35b8a875256b5163bcee25b2264d0e2dfe210e5c9a
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc576131fb1
https://mazedecrypt.top/6c610cc576131fb1
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ReceiveRequest.tiff bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File renamed C:\Users\Admin\Pictures\ReceiveRequest.tiff => C:\Users\Admin\Pictures\ReceiveRequest.tiff.sgJJZL bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File renamed C:\Users\Admin\Pictures\WaitRequest.png => C:\Users\Admin\Pictures\WaitRequest.png.gIRNeni bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File renamed C:\Users\Admin\Pictures\CompareStop.raw => C:\Users\Admin\Pictures\CompareStop.raw.p54OW bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File renamed C:\Users\Admin\Pictures\ConnectShow.png => C:\Users\Admin\Pictures\ConnectShow.png.p54OW bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File renamed C:\Users\Admin\Pictures\DebugUninstall.tif => C:\Users\Admin\Pictures\DebugUninstall.tif.p54OW bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File renamed C:\Users\Admin\Pictures\PushPublish.raw => C:\Users\Admin\Pictures\PushPublish.raw.sgJJZL bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc576131fb1.tmp bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 31 IoCs
description ioc Process File opened for modification C:\Program Files\ExitClose.mov bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\ConvertToRemove.inf bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\RegisterDebug.nfo bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\ResetAssert.lock bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\WriteSend.mpeg bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files (x86)\6c610cc576131fb1.tmp bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File created C:\Program Files\DECRYPT-FILES.txt bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\InitializeSelect.3gp2 bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\MeasureOut.ppsx bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\MoveRevoke.asx bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\OutSend.wps bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\RegisterFind.emf bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\ResumeCompress.html bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc576131fb1.tmp bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc576131fb1.tmp bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\HideMeasure.mht bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\ResetRequest.crw bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\6c610cc576131fb1.tmp bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\CompareComplete.xltm bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\DenyUpdate.mp3 bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\OutRevoke.i64 bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc576131fb1.tmp bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\SendEnter.png bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\InitializeMount.asx bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\RemoveFormat.au bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\RepairClear.raw bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File opened for modification C:\Program Files\SyncCompress.bat bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1680 bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 456 vssvc.exe Token: SeRestorePrivilege 456 vssvc.exe Token: SeAuditPrivilege 456 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe"C:\Users\Admin\AppData\Local\Temp\bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:456