Analysis
-
max time kernel
164s -
max time network
184s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16/02/2022, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe
Resource
win10v2004-en-20220113
General
-
Target
83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe
-
Size
483KB
-
MD5
a3a3495ae2fc83479baeaf1878e1ea84
-
SHA1
8a5dd867f48e4233b60938818245ea45869d074f
-
SHA256
83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279
-
SHA512
53b799af287652f431f400e2da1d7ed935f1ed8af108188cdd9a963cc040d07cbb4f0b638980e421b1601f263054b11b7bdd38db5bd068575e7dd05f1ab9485f
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/88380999367a45b4
https://mazedecrypt.top/88380999367a45b4
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ijd4bh.tmp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 35 IoCs
description ioc Process File opened for modification C:\Program Files\ReadStop.xls 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\DismountSync.tif 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\LockConnect.WTV 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\StopAssert.inf 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\SubmitTest.asp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\BackupConnect.mpeg 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\ConvertFromCompare.AAC 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\DenySend.ttc 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\DisableComplete.snd 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\SwitchRevoke.cfg 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\RestoreUndo.vstx 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files (x86)\ijd4bh.tmp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\ijd4bh.tmp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\ijd4bh.tmp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File created C:\Program Files\DECRYPT-FILES.txt 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\InvokeConnect.tmp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\SubmitOut.aif 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\SplitUnpublish.eprtx 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\AddResolve.i64 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\CompareUndo.ico 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\ReceivePing.DVR-MS 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\ShowUse.bat 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\StopImport.xla 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\ijd4bh.tmp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\LockClose.snd 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\SyncImport.pcx 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\UnlockRepair.au3 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\DebugCompress.001 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\FindAssert.i64 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\ijd4bh.tmp 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe File opened for modification C:\Program Files\ReceiveConvertTo.mov 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1664 83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1388 vssvc.exe Token: SeRestorePrivilege 1388 vssvc.exe Token: SeAuditPrivilege 1388 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe"C:\Users\Admin\AppData\Local\Temp\83f8ce81f71d6f0b1ddc6b4f3add7a5deef8367a29f59b564c9539d6653d1279.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1388