Analysis
-
max time kernel
159s -
max time network
173s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:42
Static task
static1
Behavioral task
behavioral1
Sample
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe
Resource
win10v2004-en-20220112
General
-
Target
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe
-
Size
462KB
-
MD5
65d519091daa6724a70a479f94995929
-
SHA1
81ee534d493a4fbdae734f0a32be104e4f121480
-
SHA256
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66
-
SHA512
3b203ed3c244502553d3a210a0d0445decd9c7aab2fd3a20e2770a072ffa56fdc3534737aca14cb596a33345c935e9e4c7284ac9651c56efc80dc9883d7a2828
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/883809997be7ca79
https://mazedecrypt.top/883809997be7ca79
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ResumeApprove.png => C:\Users\Admin\Pictures\ResumeApprove.png.OrRGi6 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File renamed C:\Users\Admin\Pictures\ResumeDisable.png => C:\Users\Admin\Pictures\ResumeDisable.png.OrRGi6 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File renamed C:\Users\Admin\Pictures\SaveSplit.png => C:\Users\Admin\Pictures\SaveSplit.png.OrRGi6 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File renamed C:\Users\Admin\Pictures\SkipDeny.crw => C:\Users\Admin\Pictures\SkipDeny.crw.AbjV b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\883809997be7ca79.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\BlockHide.mpeg3 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\CompareExit.asx b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\ExpandConfirm.pcx b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\PublishBlock.TS b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\SkipCopy.tiff b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\883809997be7ca79.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\MeasureTest.MOD b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\SuspendSet.rar b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files (x86)\883809997be7ca79.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\883809997be7ca79.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\CopyRepair.ppsm b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\InitializeMount.cmd b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\UninstallRestart.jpeg b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File created C:\Program Files\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\ExpandWrite.vsdm b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\883809997be7ca79.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\883809997be7ca79.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1608 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 384 vssvc.exe Token: SeRestorePrivilege 384 vssvc.exe Token: SeAuditPrivilege 384 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe"C:\Users\Admin\AppData\Local\Temp\b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1608
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:384