Analysis
-
max time kernel
166s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:59
Static task
static1
Behavioral task
behavioral1
Sample
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998.dll
Resource
win10v2004-en-20220112
General
-
Target
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998.dll
-
Size
593KB
-
MD5
724bd2d25bfca6a5fc831250d352fe0a
-
SHA1
4db3b2c8ef3321192dc47f0cad72ca8a9702bbef
-
SHA256
557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998
-
SHA512
430b113a440e3595234272720119093c4098bddcf98f8adfad9fba4f385d2e67bcc332fa749c0f3c77aecf2dc727d83a9cd9b6b639e4205359aceabeaa21c581
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5f1470002
https://mazedecrypt.top/6c610cc5f1470002
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\CloseOut.tif => C:\Users\Admin\Pictures\CloseOut.tif.j5wLZWw regsvr32.exe File renamed C:\Users\Admin\Pictures\CloseSync.crw => C:\Users\Admin\Pictures\CloseSync.crw.j5wLZWw regsvr32.exe File renamed C:\Users\Admin\Pictures\EnterReceive.crw => C:\Users\Admin\Pictures\EnterReceive.crw.j5wLZWw regsvr32.exe File renamed C:\Users\Admin\Pictures\InitializeMeasure.png => C:\Users\Admin\Pictures\InitializeMeasure.png.j5wLZWw regsvr32.exe File renamed C:\Users\Admin\Pictures\MeasureMerge.raw => C:\Users\Admin\Pictures\MeasureMerge.raw.ugiS regsvr32.exe File renamed C:\Users\Admin\Pictures\MergeUninstall.tif => C:\Users\Admin\Pictures\MergeUninstall.tif.ugiS regsvr32.exe File renamed C:\Users\Admin\Pictures\UnblockExport.crw => C:\Users\Admin\Pictures\UnblockExport.crw.ugiS regsvr32.exe File renamed C:\Users\Admin\Pictures\WatchSearch.png => C:\Users\Admin\Pictures\WatchSearch.png.I0NfaT regsvr32.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc5f1470002.tmp regsvr32.exe -
Drops file in Program Files directory 44 IoCs
description ioc Process File opened for modification C:\Program Files\BlockConfirm.nfo regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc5f1470002.tmp regsvr32.exe File opened for modification C:\Program Files\CheckpointSearch.aiff regsvr32.exe File opened for modification C:\Program Files\UnregisterReceive.csv regsvr32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\SubmitRestore.midi regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc5f1470002.tmp regsvr32.exe File opened for modification C:\Program Files\ConvertFromJoin.mpe regsvr32.exe File opened for modification C:\Program Files\EnableMeasure.csv regsvr32.exe File opened for modification C:\Program Files\RenameBlock.docx regsvr32.exe File opened for modification C:\Program Files\FindPing.tif regsvr32.exe File opened for modification C:\Program Files\SetReset.3g2 regsvr32.exe File opened for modification C:\Program Files\UseFind.jpe regsvr32.exe File created C:\Program Files\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\ClearConvert.pot regsvr32.exe File opened for modification C:\Program Files\ExitMeasure.ocx regsvr32.exe File opened for modification C:\Program Files\UnblockPop.wpl regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc5f1470002.tmp regsvr32.exe File opened for modification C:\Program Files\6c610cc5f1470002.tmp regsvr32.exe File opened for modification C:\Program Files\DenyComplete.wmf regsvr32.exe File opened for modification C:\Program Files\ResumeShow.inf regsvr32.exe File opened for modification C:\Program Files\ExportMove.php regsvr32.exe File opened for modification C:\Program Files\GetTrace.ogg regsvr32.exe File opened for modification C:\Program Files\TraceJoin.fon regsvr32.exe File opened for modification C:\Program Files\UnpublishPop.easmx regsvr32.exe File opened for modification C:\Program Files (x86)\6c610cc5f1470002.tmp regsvr32.exe File opened for modification C:\Program Files\ClearRename.m4a regsvr32.exe File opened for modification C:\Program Files\ConvertRename.xht regsvr32.exe File opened for modification C:\Program Files\EditInitialize.cab regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\EnterWait.wax regsvr32.exe File opened for modification C:\Program Files\InvokeReceive.temp regsvr32.exe File opened for modification C:\Program Files\MountRepair.ex_ regsvr32.exe File opened for modification C:\Program Files\UnprotectSync.mpeg3 regsvr32.exe File opened for modification C:\Program Files\CompareTest.xlsx regsvr32.exe File opened for modification C:\Program Files\CompleteLimit.xht regsvr32.exe File opened for modification C:\Program Files\ConfirmDisconnect.3gp regsvr32.exe File opened for modification C:\Program Files\SyncCopy.AAC regsvr32.exe File opened for modification C:\Program Files\WriteGroup.xml regsvr32.exe File opened for modification C:\Program Files\PushInstall.tiff regsvr32.exe File opened for modification C:\Program Files\RegisterDismount.jpg regsvr32.exe File opened for modification C:\Program Files\RevokeMeasure.i64 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1672 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1396 vssvc.exe Token: SeRestorePrivilege 1396 vssvc.exe Token: SeAuditPrivilege 1396 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1316 wrote to memory of 1672 1316 regsvr32.exe 27 PID 1316 wrote to memory of 1672 1316 regsvr32.exe 27 PID 1316 wrote to memory of 1672 1316 regsvr32.exe 27 PID 1316 wrote to memory of 1672 1316 regsvr32.exe 27 PID 1316 wrote to memory of 1672 1316 regsvr32.exe 27 PID 1316 wrote to memory of 1672 1316 regsvr32.exe 27 PID 1316 wrote to memory of 1672 1316 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\557f62d5df8380b0602e60b3a3b4b46639633ad8c35b7376cf02057be9a3c998.dll2⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396