Analysis
-
max time kernel
160s -
max time network
183s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:44
Static task
static1
Behavioral task
behavioral1
Sample
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe
Resource
win10v2004-en-20220112
General
-
Target
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe
-
Size
1.1MB
-
MD5
622fc2a2a3ff40714efeb318c6d528b1
-
SHA1
198a83f11b548695aa7b9736fdc8fa6b1527ba4c
-
SHA256
a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56
-
SHA512
3c8b0979f4e3f8ebe97a82d120d5bb65d783304bfa88e82c76d8590ec53683b58aa5f7e3ec56ebe2e6a946268d0973c9f3c173979194fa57069194ebe180bd54
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8dd6b14c8
https://mazedecrypt.top/6d570cc8dd6b14c8
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\InvokeExit.tiff a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File renamed C:\Users\Admin\Pictures\InvokeExit.tiff => C:\Users\Admin\Pictures\InvokeExit.tiff.WUl2s a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File renamed C:\Users\Admin\Pictures\ProtectDeny.raw => C:\Users\Admin\Pictures\ProtectDeny.raw.kvbXa3 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File renamed C:\Users\Admin\Pictures\ReadSwitch.crw => C:\Users\Admin\Pictures\ReadSwitch.crw.kvbXa3 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File renamed C:\Users\Admin\Pictures\UninstallExpand.tif => C:\Users\Admin\Pictures\UninstallExpand.tif.Tct0Tr a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File renamed C:\Users\Admin\Pictures\ConvertFromRename.png => C:\Users\Admin\Pictures\ConvertFromRename.png.mdYg4KO a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File renamed C:\Users\Admin\Pictures\ConvertStop.raw => C:\Users\Admin\Pictures\ConvertStop.raw.hrSD a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File renamed C:\Users\Admin\Pictures\DisconnectUpdate.raw => C:\Users\Admin\Pictures\DisconnectUpdate.raw.WUl2s a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d570cc8dd6b14c8.tmp a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe -
Drops file in Program Files directory 29 IoCs
description ioc Process File opened for modification C:\Program Files\CompressAssert.iso a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\FindRemove.vdx a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\ReadPop.doc a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\WriteUnpublish.cr2 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\PingHide.xltm a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\SubmitWatch.vdx a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\SwitchStep.scf a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\AssertUse.tif a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\InstallConvertFrom.mp4v a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\SwitchImport.mpa a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6d570cc8dd6b14c8.tmp a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\DisableSearch.3gpp a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\PushOpen.3gp2 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6d570cc8dd6b14c8.tmp a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6d570cc8dd6b14c8.tmp a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\MergeUnlock.nfo a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files (x86)\6d570cc8dd6b14c8.tmp a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\UnregisterBlock.pub a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\UpdateFind.dwfx a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\6d570cc8dd6b14c8.tmp a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\DisableRequest.cr2 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\PushTrace.gif a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\SaveExpand.wpl a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File created C:\Program Files\DECRYPT-FILES.txt a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File opened for modification C:\Program Files\DisconnectGrant.ttf a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1472 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeBackupPrivilege 336 vssvc.exe Token: SeRestorePrivilege 336 vssvc.exe Token: SeAuditPrivilege 336 vssvc.exe Token: SeIncreaseQuotaPrivilege 1708 wmic.exe Token: SeSecurityPrivilege 1708 wmic.exe Token: SeTakeOwnershipPrivilege 1708 wmic.exe Token: SeLoadDriverPrivilege 1708 wmic.exe Token: SeSystemProfilePrivilege 1708 wmic.exe Token: SeSystemtimePrivilege 1708 wmic.exe Token: SeProfSingleProcessPrivilege 1708 wmic.exe Token: SeIncBasePriorityPrivilege 1708 wmic.exe Token: SeCreatePagefilePrivilege 1708 wmic.exe Token: SeBackupPrivilege 1708 wmic.exe Token: SeRestorePrivilege 1708 wmic.exe Token: SeShutdownPrivilege 1708 wmic.exe Token: SeDebugPrivilege 1708 wmic.exe Token: SeSystemEnvironmentPrivilege 1708 wmic.exe Token: SeRemoteShutdownPrivilege 1708 wmic.exe Token: SeUndockPrivilege 1708 wmic.exe Token: SeManageVolumePrivilege 1708 wmic.exe Token: 33 1708 wmic.exe Token: 34 1708 wmic.exe Token: 35 1708 wmic.exe Token: SeIncreaseQuotaPrivilege 1708 wmic.exe Token: SeSecurityPrivilege 1708 wmic.exe Token: SeTakeOwnershipPrivilege 1708 wmic.exe Token: SeLoadDriverPrivilege 1708 wmic.exe Token: SeSystemProfilePrivilege 1708 wmic.exe Token: SeSystemtimePrivilege 1708 wmic.exe Token: SeProfSingleProcessPrivilege 1708 wmic.exe Token: SeIncBasePriorityPrivilege 1708 wmic.exe Token: SeCreatePagefilePrivilege 1708 wmic.exe Token: SeBackupPrivilege 1708 wmic.exe Token: SeRestorePrivilege 1708 wmic.exe Token: SeShutdownPrivilege 1708 wmic.exe Token: SeDebugPrivilege 1708 wmic.exe Token: SeSystemEnvironmentPrivilege 1708 wmic.exe Token: SeRemoteShutdownPrivilege 1708 wmic.exe Token: SeUndockPrivilege 1708 wmic.exe Token: SeManageVolumePrivilege 1708 wmic.exe Token: 33 1708 wmic.exe Token: 34 1708 wmic.exe Token: 35 1708 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1472 wrote to memory of 1708 1472 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe 35 PID 1472 wrote to memory of 1708 1472 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe 35 PID 1472 wrote to memory of 1708 1472 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe 35 PID 1472 wrote to memory of 1708 1472 a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe"C:\Users\Admin\AppData\Local\Temp\a5a0e5e73fc80dd5e70e1874a060b8a7c2c25b26aec5f54b123771a8535d1c56.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\system32\wbem\wmic.exe"C:\y\uk\ar\..\..\..\Windows\qss\u\u\..\..\..\system32\svlty\..\wbem\seew\ntfc\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:336
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1724