Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
187s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16/02/2022, 22:44
Static task
static1
Behavioral task
behavioral1
Sample
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe
Resource
win10v2004-en-20220113
General
-
Target
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe
-
Size
364KB
-
MD5
8540030a0ea3e18e84af7ce026ab9cad
-
SHA1
4ccfe4cf5839024e768520c63e3a1982eee092f0
-
SHA256
a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2
-
SHA512
8b7f32f3c4409cf3d5f69c32302c908086a4a156200fa3fb197bac957a0942a516349951633d09510b2f1c73bc02186f860467280cd36bbcebbdf1d0a974bb05
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8838099934d2f0d4
https://mazedecrypt.top/8838099934d2f0d4
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8838099934d2f0d4.tmp a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 31 IoCs
description ioc Process File opened for modification C:\Program Files\SwitchTrace.mov a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\UseStep.js a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\PopGroup.kix a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\SuspendSwitch.php a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\8838099934d2f0d4.tmp a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File created C:\Program Files\DECRYPT-FILES.txt a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\MoveResume.3gp2 a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files (x86)\8838099934d2f0d4.tmp a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\DismountSkip.js a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\FormatOut.xltm a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\ResumeDebug.ico a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\RevokeResolve.dwfx a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\SyncDeny.pdf a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\8838099934d2f0d4.tmp a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\AddSearch.m3u a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\CompareOpen.sql a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\RemoveWatch.csv a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\8838099934d2f0d4.tmp a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\8838099934d2f0d4.tmp a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\ClearMove.docx a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\ExitDisable.wmv a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\ExportBlock.odp a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\GetEdit.aif a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\MoveSet.midi a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\CheckpointRestart.aifc a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\InstallAssert.mpeg3 a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe File opened for modification C:\Program Files\ProtectEdit.dxf a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 836 a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1648 vssvc.exe Token: SeRestorePrivilege 1648 vssvc.exe Token: SeAuditPrivilege 1648 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe"C:\Users\Admin\AppData\Local\Temp\a6ac82fc87e552476a77c8d22e2d1d64fa17cc3dea9f428a53776354c97825b2.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:836
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648