Analysis
-
max time kernel
152s -
max time network
177s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:52
Static task
static1
Behavioral task
behavioral1
Sample
78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe
Resource
win10v2004-en-20220112
General
-
Target
78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe
-
Size
364KB
-
MD5
57e3d794b333f6ba4d2a968a54c7f7d8
-
SHA1
e850e2963deaea7e6d43c1390f4d69b20ed62a67
-
SHA256
78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a
-
SHA512
427820fb45cfd1a95e37fd36da5c48917547eb6c1ed727f3d9dbaec337cc2ad43d74e4d043fb603a078e42205822bf1055fa1c04707845ceeced5ef03f30127f
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc59aff5ff4
https://mazedecrypt.top/6c610cc59aff5ff4
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\CompleteResolve.tif => C:\Users\Admin\Pictures\CompleteResolve.tif.vrz5ia 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File renamed C:\Users\Admin\Pictures\ExportOpen.tif => C:\Users\Admin\Pictures\ExportOpen.tif.vrz5ia 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File renamed C:\Users\Admin\Pictures\FormatLock.crw => C:\Users\Admin\Pictures\FormatLock.crw.vrz5ia 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File renamed C:\Users\Admin\Pictures\OpenUnpublish.raw => C:\Users\Admin\Pictures\OpenUnpublish.raw.PYUpWck 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File renamed C:\Users\Admin\Pictures\ResolveEnable.png => C:\Users\Admin\Pictures\ResolveEnable.png.SMlk 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File renamed C:\Users\Admin\Pictures\UnprotectRead.png => C:\Users\Admin\Pictures\UnprotectRead.png.QioN 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File renamed C:\Users\Admin\Pictures\CheckpointDismount.raw => C:\Users\Admin\Pictures\CheckpointDismount.raw.aADHNR 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File renamed C:\Users\Admin\Pictures\CompareWait.crw => C:\Users\Admin\Pictures\CompareWait.crw.aADHNR 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc59aff5ff4.tmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 29 IoCs
description ioc Process File opened for modification C:\Program Files\FindGrant.mpp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\StopShow.ps1xml 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\TestExit.bmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\ExitImport.txt 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\UnpublishEnable.mov 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\WatchCheckpoint.001 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File created C:\Program Files\DECRYPT-FILES.txt 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\TracePublish.gif 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files (x86)\6c610cc59aff5ff4.tmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\OpenSplit.tmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\PingComplete.asx 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\SendRemove.js 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc59aff5ff4.tmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\6c610cc59aff5ff4.tmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\CompareMount.wav 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\RestoreJoin.xml 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\CloseUse.mpeg2 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\ConnectMerge.rm 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\DebugStep.vdx 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\TraceRepair.mov 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\ResumeExpand.bat 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\UnlockDeny.wps 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc59aff5ff4.tmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files\GroupNew.m4v 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc59aff5ff4.tmp 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1180 78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 564 vssvc.exe Token: SeRestorePrivilege 564 vssvc.exe Token: SeAuditPrivilege 564 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe"C:\Users\Admin\AppData\Local\Temp\78fb8d34cf3e034fbbaefd8f7587bd364a000a1e12c4a6fa45e192d56b93a25a.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1180
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:564