General
-
Target
38cc87cc48cdb89a2ab1ffaa0897c10ba4a26ff645f16d9cd5a8bc8debf255c6
-
Size
3.7MB
-
Sample
220511-292x5acfc8
-
MD5
e14c0622af40260fec213c4100605bfb
-
SHA1
2cc388e5e5ccb150604e3e5c0a715a8974a274c7
-
SHA256
38cc87cc48cdb89a2ab1ffaa0897c10ba4a26ff645f16d9cd5a8bc8debf255c6
-
SHA512
e0ae9b2f70b6460672079b907cd30fc228b2245b60315561651a09de1516424aeb770383b5cd7468926c5cfb221f130787d536d87b0941fe09cdb47af40a2d05
Static task
static1
Behavioral task
behavioral1
Sample
38cc87cc48cdb89a2ab1ffaa0897c10ba4a26ff645f16d9cd5a8bc8debf255c6.exe
Resource
win7-20220414-en
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/885e098f6d421a7f
https://mazedecrypt.top/885e098f6d421a7f
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/87c609897feb7e9c
https://mazedecrypt.top/87c609897feb7e9c
Targets
-
-
Target
38cc87cc48cdb89a2ab1ffaa0897c10ba4a26ff645f16d9cd5a8bc8debf255c6
-
Size
3.7MB
-
MD5
e14c0622af40260fec213c4100605bfb
-
SHA1
2cc388e5e5ccb150604e3e5c0a715a8974a274c7
-
SHA256
38cc87cc48cdb89a2ab1ffaa0897c10ba4a26ff645f16d9cd5a8bc8debf255c6
-
SHA512
e0ae9b2f70b6460672079b907cd30fc228b2245b60315561651a09de1516424aeb770383b5cd7468926c5cfb221f130787d536d87b0941fe09cdb47af40a2d05
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-