Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:53
Static task
static1
Behavioral task
behavioral1
Sample
7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe
Resource
win10v2004-en-20220113
General
-
Target
7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe
-
Size
1.1MB
-
MD5
36933b29eb2ebb358f7cb7dde4909d11
-
SHA1
99d84cdea97acb6b28fba07817246d901f26322a
-
SHA256
7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1
-
SHA512
72341cb8599c11c9f27cf1d2174e52f9c8de69d59885d0521b39267a9b03441dea657c07e090d80f7dae59eebfe35dd1e9715f067ae10d4281f060fc1bc8da3f
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5e8b1124a
https://mazedecrypt.top/6c610cc5e8b1124a
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\UnlockPop.png => C:\Users\Admin\Pictures\UnlockPop.png.V6WZ 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File renamed C:\Users\Admin\Pictures\WriteConvertFrom.raw => C:\Users\Admin\Pictures\WriteConvertFrom.raw.V6WZ 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File renamed C:\Users\Admin\Pictures\InvokeClear.crw => C:\Users\Admin\Pictures\InvokeClear.crw.pGkoF7 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Users\Admin\Pictures\ResolveConvertFrom.tiff 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File renamed C:\Users\Admin\Pictures\ResolveConvertFrom.tiff => C:\Users\Admin\Pictures\ResolveConvertFrom.tiff.pGkoF7 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File renamed C:\Users\Admin\Pictures\SelectAdd.png => C:\Users\Admin\Pictures\SelectAdd.png.vi9b8FF 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc5e8b1124a.tmp 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\ResumeConvert.pcx 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\SyncHide.i64 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc5e8b1124a.tmp 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\InvokeTrace.001 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\RepairConnect.kix 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\ExpandClose.vssx 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\InvokeInitialize.mpv2 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\RepairWatch.ods 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\WaitUse.mpe 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files (x86)\6c610cc5e8b1124a.tmp 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc5e8b1124a.tmp 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\6c610cc5e8b1124a.tmp 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\CompressRegister.7z 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\UninstallOpen.mov 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc5e8b1124a.tmp 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File created C:\Program Files\DECRYPT-FILES.txt 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\ConvertToNew.mp4 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\ExportDisconnect.TS 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe File opened for modification C:\Program Files\ImportUnregister.vdw 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 960 7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1820 vssvc.exe Token: SeRestorePrivilege 1820 vssvc.exe Token: SeAuditPrivilege 1820 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe"C:\Users\Admin\AppData\Local\Temp\7656d6519e0305bd95d4228387ffcd7b419ed7ede733b077755d1773f24302b1.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:960
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820