Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16/02/2022, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe
Resource
win10v2004-en-20220113
General
-
Target
927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe
-
Size
684KB
-
MD5
1aaaf2ecd5cab040665d32d9f059e12f
-
SHA1
7b3cafb0bf5b50e6bbb5066d5a61609fd8f142a0
-
SHA256
927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e
-
SHA512
49720351aeb789a6efde02b95d943d710f08265521771322ba5e538110bee4c0c17c757631675ef9f37981aac74ec2ada287c88d438c48fda0415bb8cbcbdbdf
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/8802099c22d5eff0
https://mazedecrypt.top/8802099c22d5eff0
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SaveExpand.png => C:\Users\Admin\Pictures\SaveExpand.png.9Lqy 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File renamed C:\Users\Admin\Pictures\UnblockSkip.raw => C:\Users\Admin\Pictures\UnblockSkip.raw.NOu9K 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File renamed C:\Users\Admin\Pictures\CompareGroup.png => C:\Users\Admin\Pictures\CompareGroup.png.0VX85 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File renamed C:\Users\Admin\Pictures\ConfirmUnpublish.tif => C:\Users\Admin\Pictures\ConfirmUnpublish.tif.0VX85 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File renamed C:\Users\Admin\Pictures\ConvertToSwitch.raw => C:\Users\Admin\Pictures\ConvertToSwitch.raw.0VX85 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8802099c22d5eff0.tmp 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\8802099c22d5eff0.tmp 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\DisableStop.mhtml 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\ExitTrace.jpeg 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\PingNew.jpeg 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\TestAssert.m4a 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\ConvertDisable.pptm 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\SyncInstall.png 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\SendCopy.pptm 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\SubmitWait.tiff 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\WaitUndo.jpg 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\CompleteGrant.vsdm 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\InitializeBlock.mp3 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\RenameCheckpoint.zip 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\RevokeUpdate.mov 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\SelectSync.fon 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\WatchRemove.xla 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files (x86)\8802099c22d5eff0.tmp 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File created C:\Program Files\DECRYPT-FILES.txt 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\8802099c22d5eff0.tmp 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\MountDeny.html 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\ProtectUpdate.ps1 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe File opened for modification C:\Program Files\WatchUnlock.AAC 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2764 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe 2764 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeBackupPrivilege 112 vssvc.exe Token: SeRestorePrivilege 112 vssvc.exe Token: SeAuditPrivilege 112 vssvc.exe Token: SeIncreaseQuotaPrivilege 4664 wmic.exe Token: SeSecurityPrivilege 4664 wmic.exe Token: SeTakeOwnershipPrivilege 4664 wmic.exe Token: SeLoadDriverPrivilege 4664 wmic.exe Token: SeSystemProfilePrivilege 4664 wmic.exe Token: SeSystemtimePrivilege 4664 wmic.exe Token: SeProfSingleProcessPrivilege 4664 wmic.exe Token: SeIncBasePriorityPrivilege 4664 wmic.exe Token: SeCreatePagefilePrivilege 4664 wmic.exe Token: SeBackupPrivilege 4664 wmic.exe Token: SeRestorePrivilege 4664 wmic.exe Token: SeShutdownPrivilege 4664 wmic.exe Token: SeDebugPrivilege 4664 wmic.exe Token: SeSystemEnvironmentPrivilege 4664 wmic.exe Token: SeRemoteShutdownPrivilege 4664 wmic.exe Token: SeUndockPrivilege 4664 wmic.exe Token: SeManageVolumePrivilege 4664 wmic.exe Token: 33 4664 wmic.exe Token: 34 4664 wmic.exe Token: 35 4664 wmic.exe Token: 36 4664 wmic.exe Token: SeIncreaseQuotaPrivilege 4664 wmic.exe Token: SeSecurityPrivilege 4664 wmic.exe Token: SeTakeOwnershipPrivilege 4664 wmic.exe Token: SeLoadDriverPrivilege 4664 wmic.exe Token: SeSystemProfilePrivilege 4664 wmic.exe Token: SeSystemtimePrivilege 4664 wmic.exe Token: SeProfSingleProcessPrivilege 4664 wmic.exe Token: SeIncBasePriorityPrivilege 4664 wmic.exe Token: SeCreatePagefilePrivilege 4664 wmic.exe Token: SeBackupPrivilege 4664 wmic.exe Token: SeRestorePrivilege 4664 wmic.exe Token: SeShutdownPrivilege 4664 wmic.exe Token: SeDebugPrivilege 4664 wmic.exe Token: SeSystemEnvironmentPrivilege 4664 wmic.exe Token: SeRemoteShutdownPrivilege 4664 wmic.exe Token: SeUndockPrivilege 4664 wmic.exe Token: SeManageVolumePrivilege 4664 wmic.exe Token: 33 4664 wmic.exe Token: 34 4664 wmic.exe Token: 35 4664 wmic.exe Token: 36 4664 wmic.exe Token: 33 380 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 380 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2764 wrote to memory of 4664 2764 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe 95 PID 2764 wrote to memory of 4664 2764 927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe"C:\Users\Admin\AppData\Local\Temp\927492289f2c081dafcb2c0d741934cf9d4b76a9b5e739215f5d320bea112a8e.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\wbem\wmic.exe"C:\ji\..\Windows\gbns\m\..\..\system32\rnda\..\wbem\hm\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:112
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x38c 0x4a81⤵
- Suspicious use of AdjustPrivilegeToken
PID:380