Overview
overview
10Static
static
101.exe
windows7_x64
61.exe
windows10-2004_x64
610.exe
windows7_x64
1010.exe
windows10-2004_x64
102.doc
windows7_x64
102.doc
windows10-2004_x64
13.xlsx
windows7_x64
103.xlsx
windows10-2004_x64
14.exe
windows7_x64
104.exe
windows10-2004_x64
15.exe
windows7_x64
105.exe
windows10-2004_x64
16.exe
windows7_x64
106.exe
windows10-2004_x64
107.exe
windows7_x64
107.exe
windows10-2004_x64
18.exe
windows7_x64
108.exe
windows10-2004_x64
109.docm
windows7_x64
109.docm
windows10-2004_x64
10rip.bat
windows7_x64
10rip.bat
windows10-2004_x64
10Analysis
-
max time kernel
165s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
23-03-2022 21:00
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
10.exe
Resource
win7-20220310-en
Behavioral task
behavioral4
Sample
10.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
2.doc
Resource
win7-20220311-en
Behavioral task
behavioral6
Sample
2.doc
Resource
win10v2004-20220310-en
Behavioral task
behavioral7
Sample
3.xlsx
Resource
win7-20220311-en
Behavioral task
behavioral8
Sample
3.xlsx
Resource
win10v2004-20220310-en
Behavioral task
behavioral9
Sample
4.exe
Resource
win7-20220311-en
Behavioral task
behavioral10
Sample
4.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
5.exe
Resource
win7-20220310-en
Behavioral task
behavioral12
Sample
5.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral13
Sample
6.exe
Resource
win7-20220310-en
Behavioral task
behavioral14
Sample
6.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
7.exe
Resource
win7-20220311-en
Behavioral task
behavioral16
Sample
7.exe
Resource
win10v2004-20220310-en
Behavioral task
behavioral17
Sample
8.exe
Resource
win7-20220311-en
Behavioral task
behavioral18
Sample
8.exe
Resource
win10v2004-20220310-en
Behavioral task
behavioral19
Sample
9.docm
Resource
win7-20220311-en
Behavioral task
behavioral20
Sample
9.docm
Resource
win10v2004-en-20220113
Behavioral task
behavioral21
Sample
rip.bat
Resource
win7-20220310-en
Behavioral task
behavioral22
Sample
rip.bat
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d2f0cd52fc97737
https://mazedecrypt.top/6d2f0cd52fc97737
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
8.exedescription ioc process File renamed C:\Users\Admin\Pictures\AssertConvertFrom.tiff => C:\Users\Admin\Pictures\AssertConvertFrom.tiff.ekyc 8.exe File renamed C:\Users\Admin\Pictures\CheckpointUnpublish.raw => C:\Users\Admin\Pictures\CheckpointUnpublish.raw.u9G2gD 8.exe File renamed C:\Users\Admin\Pictures\DenyPublish.tif => C:\Users\Admin\Pictures\DenyPublish.tif.u9G2gD 8.exe File opened for modification C:\Users\Admin\Pictures\AssertConvertFrom.tiff 8.exe -
Drops startup file 4 IoCs
Processes:
8.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6d2f0cd52fc97737.tmp 8.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d2f0cd52fc97737.tmp 8.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt 8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 8.exe -
Drops file in Program Files directory 38 IoCs
Processes:
8.exedescription ioc process File opened for modification C:\Program Files\6d2f0cd52fc97737.tmp 8.exe File opened for modification C:\Program Files\ConvertPublish.ps1xml 8.exe File opened for modification C:\Program Files\CopyStart.html 8.exe File opened for modification C:\Program Files\InitializeOut.emz 8.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 8.exe File opened for modification C:\Program Files\ExportEdit.fon 8.exe File opened for modification C:\Program Files\RestoreCopy.wma 8.exe File opened for modification C:\Program Files\UndoEdit.001 8.exe File opened for modification C:\Program Files\CheckpointRestart.dib 8.exe File opened for modification C:\Program Files\CloseCheckpoint.cmd 8.exe File opened for modification C:\Program Files\InstallFind.xlt 8.exe File opened for modification C:\Program Files\MergeConvert.dot 8.exe File opened for modification C:\Program Files\SaveWait.ttc 8.exe File opened for modification C:\Program Files\SyncConvertTo.docm 8.exe File opened for modification C:\Program Files\UseEnter.css 8.exe File opened for modification C:\Program Files\PopBlock.odp 8.exe File opened for modification C:\Program Files\UnlockStep.crw 8.exe File opened for modification C:\Program Files\TestConvertTo.mov 8.exe File created C:\Program Files\DECRYPT-FILES.txt 8.exe File opened for modification C:\Program Files\AssertInitialize.otf 8.exe File opened for modification C:\Program Files\EditClose.xlsm 8.exe File opened for modification C:\Program Files\PingSubmit.dot 8.exe File opened for modification C:\Program Files\PushDebug.ADT 8.exe File opened for modification C:\Program Files\RemoveShow.htm 8.exe File opened for modification C:\Program Files\RepairComplete.tif 8.exe File opened for modification C:\Program Files\CompressGrant.ps1 8.exe File opened for modification C:\Program Files\GetInstall.pps 8.exe File opened for modification C:\Program Files\RevokeCheckpoint.contact 8.exe File opened for modification C:\Program Files\ApproveRegister.vbe 8.exe File opened for modification C:\Program Files\ExitUninstall.xht 8.exe File opened for modification C:\Program Files\MeasureConnect.mp2v 8.exe File opened for modification C:\Program Files\UninstallDebug.xml 8.exe File opened for modification C:\Program Files\UpdateSend.snd 8.exe File opened for modification C:\Program Files (x86)\6d2f0cd52fc97737.tmp 8.exe File opened for modification C:\Program Files\DisconnectHide.rtf 8.exe File opened for modification C:\Program Files\ExitRequest.jpg 8.exe File opened for modification C:\Program Files\ImportRestart.ram 8.exe File opened for modification C:\Program Files\ReadRepair.snd 8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8.exepid process 1632 8.exe 1632 8.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exewmic.exedescription pid process Token: SeBackupPrivilege 3040 vssvc.exe Token: SeRestorePrivilege 3040 vssvc.exe Token: SeAuditPrivilege 3040 vssvc.exe Token: SeIncreaseQuotaPrivilege 1324 wmic.exe Token: SeSecurityPrivilege 1324 wmic.exe Token: SeTakeOwnershipPrivilege 1324 wmic.exe Token: SeLoadDriverPrivilege 1324 wmic.exe Token: SeSystemProfilePrivilege 1324 wmic.exe Token: SeSystemtimePrivilege 1324 wmic.exe Token: SeProfSingleProcessPrivilege 1324 wmic.exe Token: SeIncBasePriorityPrivilege 1324 wmic.exe Token: SeCreatePagefilePrivilege 1324 wmic.exe Token: SeBackupPrivilege 1324 wmic.exe Token: SeRestorePrivilege 1324 wmic.exe Token: SeShutdownPrivilege 1324 wmic.exe Token: SeDebugPrivilege 1324 wmic.exe Token: SeSystemEnvironmentPrivilege 1324 wmic.exe Token: SeRemoteShutdownPrivilege 1324 wmic.exe Token: SeUndockPrivilege 1324 wmic.exe Token: SeManageVolumePrivilege 1324 wmic.exe Token: 33 1324 wmic.exe Token: 34 1324 wmic.exe Token: 35 1324 wmic.exe Token: 36 1324 wmic.exe Token: SeIncreaseQuotaPrivilege 1324 wmic.exe Token: SeSecurityPrivilege 1324 wmic.exe Token: SeTakeOwnershipPrivilege 1324 wmic.exe Token: SeLoadDriverPrivilege 1324 wmic.exe Token: SeSystemProfilePrivilege 1324 wmic.exe Token: SeSystemtimePrivilege 1324 wmic.exe Token: SeProfSingleProcessPrivilege 1324 wmic.exe Token: SeIncBasePriorityPrivilege 1324 wmic.exe Token: SeCreatePagefilePrivilege 1324 wmic.exe Token: SeBackupPrivilege 1324 wmic.exe Token: SeRestorePrivilege 1324 wmic.exe Token: SeShutdownPrivilege 1324 wmic.exe Token: SeDebugPrivilege 1324 wmic.exe Token: SeSystemEnvironmentPrivilege 1324 wmic.exe Token: SeRemoteShutdownPrivilege 1324 wmic.exe Token: SeUndockPrivilege 1324 wmic.exe Token: SeManageVolumePrivilege 1324 wmic.exe Token: 33 1324 wmic.exe Token: 34 1324 wmic.exe Token: 35 1324 wmic.exe Token: 36 1324 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
8.exedescription pid process target process PID 1632 wrote to memory of 1324 1632 8.exe wmic.exe PID 1632 wrote to memory of 1324 1632 8.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8.exe"C:\Users\Admin\AppData\Local\Temp\8.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\wbem\wmic.exe"C:\tsg\ptk\gao\..\..\..\Windows\owh\dx\wqa\..\..\..\system32\o\wnk\sdw\..\..\..\wbem\tcc\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3040