Analysis
-
max time kernel
170s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
16-02-2022 22:42
Static task
static1
Behavioral task
behavioral1
Sample
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe
Resource
win10v2004-en-20220112
General
-
Target
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe
-
Size
462KB
-
MD5
65d519091daa6724a70a479f94995929
-
SHA1
81ee534d493a4fbdae734f0a32be104e4f121480
-
SHA256
b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66
-
SHA512
3b203ed3c244502553d3a210a0d0445decd9c7aab2fd3a20e2770a072ffa56fdc3534737aca14cb596a33345c935e9e4c7284ac9651c56efc80dc9883d7a2828
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/875c0983782351ef
https://mazedecrypt.top/875c0983782351ef
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\UnpublishJoin.ps1 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\BackupFormat.cab b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\GrantPop.search-ms b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\RemoveSet.pptx b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\SelectConvert.M2T b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\SubmitMove.wav b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\InitializeOpen.jpg b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\SkipSwitch.png b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\TraceMove.inf b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\UnregisterRepair.eps b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\WatchUse.potm b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\RestoreAssert.au3 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\UseRemove.docx b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File created C:\Program Files\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\875c0983782351ef.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\FindMove.emf b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\NewFormat.3gp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\RemoveMove.mid b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\SetEdit.wmx b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\TraceReceive.bat b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files\UndoRevoke.xsl b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe File opened for modification C:\Program Files (x86)\875c0983782351ef.tmp b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 428 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe 428 b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 3160 vssvc.exe Token: SeRestorePrivilege 3160 vssvc.exe Token: SeAuditPrivilege 3160 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe"C:\Users\Admin\AppData\Local\Temp\b5e2a46be3b657aeb2dec4b3d0ff4834bf369be7d17c3d15a84600b093fd0f66.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:428
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵PID:1036