Analysis
-
max time kernel
164s -
max time network
188s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:55
Static task
static1
Behavioral task
behavioral1
Sample
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe
Resource
win10v2004-en-20220112
General
-
Target
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe
-
Size
758KB
-
MD5
76166a976c7d3cf9c02dfa118574af10
-
SHA1
7c6cac9726fa19fa2f1fd33d58f915665a460fb8
-
SHA256
6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3
-
SHA512
6d84a7701f4d118b656fec9d3d3a183f4b7e093ea923066877b9319fcfa2b18ad7fa29c254b0d4a4c1ba42cca9e90ca26296fb8f6e5a6d7a1d6bef0f78fc21bf
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc54de576e6
https://mazedecrypt.top/6c610cc54de576e6
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SwitchRequest.tif => C:\Users\Admin\Pictures\SwitchRequest.tif.nP7bEjH 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File renamed C:\Users\Admin\Pictures\UnprotectGrant.png => C:\Users\Admin\Pictures\UnprotectGrant.png.PDbP 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File renamed C:\Users\Admin\Pictures\UnregisterCompress.crw => C:\Users\Admin\Pictures\UnregisterCompress.crw.QER8I 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File renamed C:\Users\Admin\Pictures\RenameOut.tif => C:\Users\Admin\Pictures\RenameOut.tif.cjphpA 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File renamed C:\Users\Admin\Pictures\SearchMove.raw => C:\Users\Admin\Pictures\SearchMove.raw.IL1TRk 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc54de576e6.tmp 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 41 IoCs
description ioc Process File opened for modification C:\Program Files\StopInvoke.tiff 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\UseSubmit.rtf 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File created C:\Program Files\DECRYPT-FILES.txt 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\EnterGet.xps 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\FormatUnblock.mp3 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\NewUse.ps1xml 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\StepSearch.contact 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc54de576e6.tmp 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\6c610cc54de576e6.tmp 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\BackupOut.gif 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\DismountSwitch.php 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\UnpublishUnlock.3gpp 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\ConvertCompare.au3 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\RepairPush.mpe 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc54de576e6.tmp 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\AssertReceive.vstm 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\GetExport.vstm 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\ProtectComplete.vsdm 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\StartMove.mhtml 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files (x86)\6c610cc54de576e6.tmp 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\DenyDisconnect.hta 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\FindDismount.cr2 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\LockCompress.xlsb 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\RenameEnable.reg 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\UnblockNew.au3 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc54de576e6.tmp 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\DebugCopy.kix 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\FormatLimit.jpeg 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\OutUnblock.cab 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\UseConfirm.mpeg 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\UnregisterSwitch.pot 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\BackupUnregister.cmd 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\EnableAssert.m3u 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\RestoreDisable.pps 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\SubmitSearch.AAC 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\TraceRegister.wps 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe File opened for modification C:\Program Files\ShowRead.ttf 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1272 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeBackupPrivilege 272 vssvc.exe Token: SeRestorePrivilege 272 vssvc.exe Token: SeAuditPrivilege 272 vssvc.exe Token: SeIncreaseQuotaPrivilege 1588 wmic.exe Token: SeSecurityPrivilege 1588 wmic.exe Token: SeTakeOwnershipPrivilege 1588 wmic.exe Token: SeLoadDriverPrivilege 1588 wmic.exe Token: SeSystemProfilePrivilege 1588 wmic.exe Token: SeSystemtimePrivilege 1588 wmic.exe Token: SeProfSingleProcessPrivilege 1588 wmic.exe Token: SeIncBasePriorityPrivilege 1588 wmic.exe Token: SeCreatePagefilePrivilege 1588 wmic.exe Token: SeBackupPrivilege 1588 wmic.exe Token: SeRestorePrivilege 1588 wmic.exe Token: SeShutdownPrivilege 1588 wmic.exe Token: SeDebugPrivilege 1588 wmic.exe Token: SeSystemEnvironmentPrivilege 1588 wmic.exe Token: SeRemoteShutdownPrivilege 1588 wmic.exe Token: SeUndockPrivilege 1588 wmic.exe Token: SeManageVolumePrivilege 1588 wmic.exe Token: 33 1588 wmic.exe Token: 34 1588 wmic.exe Token: 35 1588 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1588 1272 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe 35 PID 1272 wrote to memory of 1588 1272 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe 35 PID 1272 wrote to memory of 1588 1272 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe 35 PID 1272 wrote to memory of 1588 1272 6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe"C:\Users\Admin\AppData\Local\Temp\6568e9ac34905c32255bab713c259d76fab2c162be84d913ab0076a05e2605c3.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\wbem\wmic.exe"C:\vn\i\u\..\..\..\Windows\hf\..\system32\jubs\dmfc\..\..\wbem\dsnyh\tu\mlg\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:272