Analysis
-
max time kernel
175s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 22:48
Static task
static1
Behavioral task
behavioral1
Sample
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05.dll
Resource
win10v2004-en-20220113
General
-
Target
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05.dll
-
Size
591KB
-
MD5
140f6f9a6b3fb5c99b61c20afb6f39d7
-
SHA1
bb1136d16e8a203da7ed10426abd8fe475e7af97
-
SHA256
90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05
-
SHA512
51a5bb962600d3574bcd9d1daa274a17950f8bff5365514eddc6f01c39a6b36247a29ab7c7fc84fa2b171c2fdc32f70c8dd28143edbc7172955b95043c9f2573
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc882a130b2
https://mazedecrypt.top/6c2b0cc882a130b2
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc Process File renamed C:\Users\Admin\Pictures\UnlockCompare.crw => C:\Users\Admin\Pictures\UnlockCompare.crw.jnnOhj regsvr32.exe File opened for modification C:\Users\Admin\Pictures\OutCheckpoint.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\OutCheckpoint.tiff => C:\Users\Admin\Pictures\OutCheckpoint.tiff.fKcr5 regsvr32.exe -
Drops startup file 4 IoCs
Processes:
regsvr32.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c2b0cc882a130b2.tmp regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6c2b0cc882a130b2.tmp regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt regsvr32.exe -
Drops file in Program Files directory 22 IoCs
Processes:
regsvr32.exedescription ioc Process File opened for modification C:\Program Files\6c2b0cc882a130b2.tmp regsvr32.exe File opened for modification C:\Program Files\MountSave.MOD regsvr32.exe File opened for modification C:\Program Files\OpenClear.pub regsvr32.exe File opened for modification C:\Program Files\RestartEnable.mpg regsvr32.exe File opened for modification C:\Program Files\UseEnter.ocx regsvr32.exe File opened for modification C:\Program Files (x86)\6c2b0cc882a130b2.tmp regsvr32.exe File created C:\Program Files\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\EditResize.DVR regsvr32.exe File opened for modification C:\Program Files\ExportApprove.otf regsvr32.exe File opened for modification C:\Program Files\LimitPublish.php regsvr32.exe File opened for modification C:\Program Files\LockMeasure.xla regsvr32.exe File opened for modification C:\Program Files\MountBlock.jpeg regsvr32.exe File opened for modification C:\Program Files\SuspendUnprotect.cmd regsvr32.exe File opened for modification C:\Program Files\MergeDeny.m3u regsvr32.exe File opened for modification C:\Program Files\RemoveHide.jpg regsvr32.exe File opened for modification C:\Program Files\SkipSwitch.edrwx regsvr32.exe File opened for modification C:\Program Files\SyncRestore.lock regsvr32.exe File opened for modification C:\Program Files\CompleteUndo.ttc regsvr32.exe File opened for modification C:\Program Files\ConvertToInitialize.jpe regsvr32.exe File opened for modification C:\Program Files\TraceDisconnect.xps regsvr32.exe File opened for modification C:\Program Files\WatchUse.html regsvr32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt regsvr32.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid Process 544 regsvr32.exe 544 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
vssvc.exesvchost.exedescription pid Process Token: SeBackupPrivilege 764 vssvc.exe Token: SeRestorePrivilege 764 vssvc.exe Token: SeAuditPrivilege 764 vssvc.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeCreatePagefilePrivilege 2112 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeCreatePagefilePrivilege 2112 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeCreatePagefilePrivilege 2112 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid Process procid_target PID 4536 wrote to memory of 544 4536 regsvr32.exe 82 PID 4536 wrote to memory of 544 4536 regsvr32.exe 82 PID 4536 wrote to memory of 544 4536 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\90ae5c78af747bb9e46118e6c1bed8228a77a4dc3d2f12d7e254c88b3208db05.dll2⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:544
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2112