Analysis
-
max time kernel
174s -
max time network
195s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:51
Static task
static1
Behavioral task
behavioral1
Sample
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe
Resource
win10v2004-en-20220113
General
-
Target
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe
-
Size
1.1MB
-
MD5
7c3e9a17f3657c090edddac72c4ef048
-
SHA1
f7300c7a32604d41f1d7d83989430a5f96cfbe4b
-
SHA256
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6
-
SHA512
686e5c5fdab16880a34bfad4d607ac722c382bbc368570c14efa2350bd517603fc8e48953796a608d01906517726007d8cbb5d1d8d249359c8706674f1480ca2
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc87c8625d6
https://mazedecrypt.top/6d570cc87c8625d6
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exedescription ioc Process File opened for modification C:\Users\Admin\Pictures\ExportSearch.tiff 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File renamed C:\Users\Admin\Pictures\ExportSearch.tiff => C:\Users\Admin\Pictures\ExportSearch.tiff.rlZw15 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Users\Admin\Pictures\InstallUnregister.tiff 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File renamed C:\Users\Admin\Pictures\InstallUnregister.tiff => C:\Users\Admin\Pictures\InstallUnregister.tiff.hXQjpS 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File renamed C:\Users\Admin\Pictures\SelectSearch.tif => C:\Users\Admin\Pictures\SelectSearch.tif.ltfn 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File renamed C:\Users\Admin\Pictures\WaitExit.raw => C:\Users\Admin\Pictures\WaitExit.raw.TUQF 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File renamed C:\Users\Admin\Pictures\ExitTrace.png => C:\Users\Admin\Pictures\ExitTrace.png.rlZw15 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe -
Drops startup file 2 IoCs
Processes:
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d570cc87c8625d6.tmp 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe -
Drops file in Program Files directory 36 IoCs
Processes:
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exedescription ioc Process File opened for modification C:\Program Files\InstallUnblock.mp3 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\MoveSave.001 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\RequestPublish.html 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\SearchCompress.docm 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\TraceGrant.scf 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\UninstallUndo.xhtml 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\CheckpointLimit.avi 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\CloseTrace.mid 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\6d570cc87c8625d6.tmp 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\OutImport.doc 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\StartCopy.gif 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\UnprotectFormat.svg 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files (x86)\6d570cc87c8625d6.tmp 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File created C:\Program Files\DECRYPT-FILES.txt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\ExportApprove.php 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\UnregisterSelect.pps 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\DenyCompress.gif 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\EditPing.avi 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\NewStart.ppsm 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\ReadCompress.jpeg 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6d570cc87c8625d6.tmp 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\FindUndo.clr 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\JoinOpen.ppt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\MeasureAdd.vbs 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\SearchSkip.odt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\UndoPublish.cr2 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6d570cc87c8625d6.tmp 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\CompleteUnblock.png 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\DisableLimit.wps 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6d570cc87c8625d6.tmp 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\OutConvertTo.rmi 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe File opened for modification C:\Program Files\ProtectGroup.zip 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exepid Process 1888 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
vssvc.exewmic.exeAUDIODG.EXEdescription pid Process Token: SeBackupPrivilege 1680 vssvc.exe Token: SeRestorePrivilege 1680 vssvc.exe Token: SeAuditPrivilege 1680 vssvc.exe Token: SeIncreaseQuotaPrivilege 1708 wmic.exe Token: SeSecurityPrivilege 1708 wmic.exe Token: SeTakeOwnershipPrivilege 1708 wmic.exe Token: SeLoadDriverPrivilege 1708 wmic.exe Token: SeSystemProfilePrivilege 1708 wmic.exe Token: SeSystemtimePrivilege 1708 wmic.exe Token: SeProfSingleProcessPrivilege 1708 wmic.exe Token: SeIncBasePriorityPrivilege 1708 wmic.exe Token: SeCreatePagefilePrivilege 1708 wmic.exe Token: SeBackupPrivilege 1708 wmic.exe Token: SeRestorePrivilege 1708 wmic.exe Token: SeShutdownPrivilege 1708 wmic.exe Token: SeDebugPrivilege 1708 wmic.exe Token: SeSystemEnvironmentPrivilege 1708 wmic.exe Token: SeRemoteShutdownPrivilege 1708 wmic.exe Token: SeUndockPrivilege 1708 wmic.exe Token: SeManageVolumePrivilege 1708 wmic.exe Token: 33 1708 wmic.exe Token: 34 1708 wmic.exe Token: 35 1708 wmic.exe Token: SeIncreaseQuotaPrivilege 1708 wmic.exe Token: SeSecurityPrivilege 1708 wmic.exe Token: SeTakeOwnershipPrivilege 1708 wmic.exe Token: SeLoadDriverPrivilege 1708 wmic.exe Token: SeSystemProfilePrivilege 1708 wmic.exe Token: SeSystemtimePrivilege 1708 wmic.exe Token: SeProfSingleProcessPrivilege 1708 wmic.exe Token: SeIncBasePriorityPrivilege 1708 wmic.exe Token: SeCreatePagefilePrivilege 1708 wmic.exe Token: SeBackupPrivilege 1708 wmic.exe Token: SeRestorePrivilege 1708 wmic.exe Token: SeShutdownPrivilege 1708 wmic.exe Token: SeDebugPrivilege 1708 wmic.exe Token: SeSystemEnvironmentPrivilege 1708 wmic.exe Token: SeRemoteShutdownPrivilege 1708 wmic.exe Token: SeUndockPrivilege 1708 wmic.exe Token: SeManageVolumePrivilege 1708 wmic.exe Token: 33 1708 wmic.exe Token: 34 1708 wmic.exe Token: 35 1708 wmic.exe Token: 33 1104 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1104 AUDIODG.EXE Token: 33 1104 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1104 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exedescription pid Process procid_target PID 1888 wrote to memory of 1708 1888 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe 35 PID 1888 wrote to memory of 1708 1888 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe 35 PID 1888 wrote to memory of 1708 1888 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe 35 PID 1888 wrote to memory of 1708 1888 7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe"C:\Users\Admin\AppData\Local\Temp\7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\wbem\wmic.exe"C:\xklkp\..\Windows\t\ejbte\..\..\system32\bf\nps\hoq\..\..\..\wbem\yw\ta\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:664
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104