Analysis
-
max time kernel
157s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 23:00
Static task
static1
Behavioral task
behavioral1
Sample
51f987ca424efa1e278fef26c8b7f26ba44ea7aa2d19f5b4dae1d9818877fe74.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
51f987ca424efa1e278fef26c8b7f26ba44ea7aa2d19f5b4dae1d9818877fe74.dll
Resource
win10v2004-en-20220113
General
-
Target
51f987ca424efa1e278fef26c8b7f26ba44ea7aa2d19f5b4dae1d9818877fe74.dll
-
Size
594KB
-
MD5
6af23009c00136a035654607fd423a24
-
SHA1
5375aa02c6dab85ece057a2e0d3603fc02f04f52
-
SHA256
51f987ca424efa1e278fef26c8b7f26ba44ea7aa2d19f5b4dae1d9818877fe74
-
SHA512
ed82a43c12c459bf3cf09b03d4db7399a76c7bcfc16f88eea334f4db1ec2768664900cb6a4c92e659112e7bd126ebf35eed32beb66f20c5d201ede1d4946b3db
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc5b1136db8
https://mazedecrypt.top/6c610cc5b1136db8
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc Process File renamed C:\Users\Admin\Pictures\SwitchBlock.tif => C:\Users\Admin\Pictures\SwitchBlock.tif.Yxqni6 regsvr32.exe File opened for modification C:\Users\Admin\Pictures\UseLimit.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\ExitOut.raw => C:\Users\Admin\Pictures\ExitOut.raw.PyMCs regsvr32.exe File renamed C:\Users\Admin\Pictures\InstallTrace.tif => C:\Users\Admin\Pictures\InstallTrace.tif.PyMCs regsvr32.exe File renamed C:\Users\Admin\Pictures\PingBlock.png => C:\Users\Admin\Pictures\PingBlock.png.VOUwY regsvr32.exe File renamed C:\Users\Admin\Pictures\ResetDismount.tiff => C:\Users\Admin\Pictures\ResetDismount.tiff.N3zoNg regsvr32.exe File renamed C:\Users\Admin\Pictures\NewEnable.png => C:\Users\Admin\Pictures\NewEnable.png.VOUwY regsvr32.exe File renamed C:\Users\Admin\Pictures\RenameClear.tif => C:\Users\Admin\Pictures\RenameClear.tif.DmD4Tr regsvr32.exe File opened for modification C:\Users\Admin\Pictures\ResetDismount.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\UseLimit.tiff => C:\Users\Admin\Pictures\UseLimit.tiff.Yxqni6 regsvr32.exe -
Drops startup file 2 IoCs
Processes:
regsvr32.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c610cc5b1136db8.tmp regsvr32.exe -
Drops file in Program Files directory 25 IoCs
Processes:
regsvr32.exedescription ioc Process File opened for modification C:\Program Files\ProtectSelect.php regsvr32.exe File opened for modification C:\Program Files\SkipConfirm.potx regsvr32.exe File opened for modification C:\Program Files\SubmitRestart.mp4 regsvr32.exe File opened for modification C:\Program Files\SwitchGet.raw regsvr32.exe File opened for modification C:\Program Files\UnregisterLimit.png regsvr32.exe File opened for modification C:\Program Files\UseSplit.ps1 regsvr32.exe File created C:\Program Files\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\ConvertFind.wav regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\MeasureUpdate.potx regsvr32.exe File opened for modification C:\Program Files\UnprotectWrite.cab regsvr32.exe File opened for modification C:\Program Files (x86)\6c610cc5b1136db8.tmp regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c610cc5b1136db8.tmp regsvr32.exe File opened for modification C:\Program Files\6c610cc5b1136db8.tmp regsvr32.exe File opened for modification C:\Program Files\GetClear.ex_ regsvr32.exe File opened for modification C:\Program Files\SetCompare.aif regsvr32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c610cc5b1136db8.tmp regsvr32.exe File opened for modification C:\Program Files\CloseSave.xps regsvr32.exe File opened for modification C:\Program Files\PopSend.wpl regsvr32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c610cc5b1136db8.tmp regsvr32.exe File opened for modification C:\Program Files\AddExit.htm regsvr32.exe File opened for modification C:\Program Files\InitializeAdd.ex_ regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid Process 1288 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid Process Token: SeBackupPrivilege 1412 vssvc.exe Token: SeRestorePrivilege 1412 vssvc.exe Token: SeAuditPrivilege 1412 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid Process procid_target PID 1464 wrote to memory of 1288 1464 regsvr32.exe 27 PID 1464 wrote to memory of 1288 1464 regsvr32.exe 27 PID 1464 wrote to memory of 1288 1464 regsvr32.exe 27 PID 1464 wrote to memory of 1288 1464 regsvr32.exe 27 PID 1464 wrote to memory of 1288 1464 regsvr32.exe 27 PID 1464 wrote to memory of 1288 1464 regsvr32.exe 27 PID 1464 wrote to memory of 1288 1464 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\51f987ca424efa1e278fef26c8b7f26ba44ea7aa2d19f5b4dae1d9818877fe74.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\51f987ca424efa1e278fef26c8b7f26ba44ea7aa2d19f5b4dae1d9818877fe74.dll2⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1288
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412