General
Target
Filesize
Completed
Task
wordupd.exe
736KB
25-05-2022 13:46
behavioral1
Score
10/10
MD5
SHA1
SHA256
SHA256
21a563f958b73d453ad91e251b11855c
64ed4f6b315448d518ed003a1d0c7e56790ef50d
067f1b8f1e0b2bfe286f5169e17834e8cf7f4266b8d97f28ea78995dc81b0e7b
3eaef227db10759c65d668317322e71cd60e60427afd4d4f5f627e9b7a9d4e6d3287b7bf32df3fa7ba2f7062ec41393a100a477668b7f4dca76c2b8932c1b9eb
Malware Config
Extracted
| Path | C:\DECRYPT-FILES.txt |
| Family | maze |
| Ransom Note |
Attention!
----------------------------
| What happened?
----------------------------
All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms.
You cannot access the files right now. But do not worry. You have a chance! It is easy to recover in a few steps.
----------------------------
| How to get my files back?
----------------------------
The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers.
To contact us and purchase the key you have to visit our website in a hidden TOR network.
There are general 2 ways to reach us:
1) [Recommended] Using hidden TOR network.
a) Download a special TOR browser: https://www.torproject.org/
b) Install the TOR Browser.
c) Open the TOR Browser.
d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/8870099cba3b4973
e) Follow the instructions on this page.
2) If you have any problems connecting or using TOR network
a) Open our website: https://mazedecrypt.top/8870099cba3b4973
b) Follow the instructions on this page.
Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use.
On this page, you will see instructions on how to make a free decryption test and how to pay.
Also it has a live chat with our operators and support team.
----------------------------
| What about guarantees?
----------------------------
We understand your stress and worry.
So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer!
If you have any problems our friendly support team is always here to assist you in a live chat!
-------------------------------------------------------------------------------
THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU
---BEGIN MAZE KEY---
oRZ4JXpLyGvAAN4q9ERpgucC5MYp1/Ev6O1qHUXF5cazqil2VEQjSx3DUSoF+grFRbLU8OYjSHbwnEjfpnzVYATJeTH7NCvfmZl/XHzFTMR+2ituapIUhpc/ErwpRRBLuMpGVs6gGiWhwpPIzWpefK48x5f/Vzck6PcVbXEK3G/BCEFG7jMKhf7GcKsqcqvESctOMez2Y52qJfSC4WW7ZRaA15cou6o/Rt6/kNnOPJrvi8Do2+qKUpe0oO2yKUVfgQaCaWddxxJkGT2MkH4wmO//urEJFAouXSjgrEk4Y/3QmTOoroZf1oU1eUpvR7QMeUR48IvPldGEOhKh3NMKSZ1dz3eG1uJU0n0E8wm6dGgbqAChlBBfdVxvn3tgiiIn+Gb/HRktgEAi2+bIC7bz6HruagBkCIiPwSK339Jip0OK6AQZP6TIYdJHMB6oTqC+kszYBracgm4NBdUDmLsYepn3TAcz8ABsobFGa7tGuNc5uQ3KxmtnzXOXPyqeCH5EbYJFleWpsv7NwjXY+ZtZ2bGfaHFMFV1nhh26ESB5+0XleFY2Dqkte8w6kNU15G0tHROJnC9EGQTyDT0WOZ8SZAIqFB6oeW8flbkOMzkCTf8KUt2BZM+wYQbJXRJkNKGW7I5Ttp4xpz1CJYBH9eFVxFPng96kBe42PAtgfjQQZrop7Ixd3F8qmoXu8mkbNczREUtmHXKS5Wn4zrDz+rwodzL491qh9SSJKUBZ/nioUba1hOsfS53Mh07Bhg2xBW3Uhx3xEWlNVXYEt0Ak1Nue42X63sB9Gpqf8gb/N2mgBtsAJYCsUfyFXYM9aIlapbjXGKiTFjbTc8GjcdPpcdhBoD+qm6A0zR4jpokKmLGpjOZDiFyFXRzITlvKfr5UwPo5FQtUa1uivh9aUG8mERm2gxIjVa+TfE2XSL2mj//wwaLh6Mz0irRi2QWhmH/I5FTu9WlvqE+CZpH7Ook2rVqAGyx59hrhDTjbk9DQ+sfoHJb5np59rqp2HuvQmoyac+Fp+e2fVacMxFulDjlhFtVvK3XOJAkVsN1fvn5Lj0M3wCd6oyIYN5+pXfi0pwNvcPJF167uYyTlRxR+OvtOIg9xrf6NJJjfYwEclU/HGMK7ImGJulplWK2+Wqznmnxp/fq+RW17D+PAABAKHvMy0wcYWKq5vTeq/oYwryOAKfMnehxBQFHATaUaBYZMDUrHkNdye6C1KQ2JtKF1QbCsVHUvAEPMviRxXZnbyzjR7hwsJtqC+s4Is56nsGv/5fU5YN70HsPPRoNLCXbRJHXoqwztBrV0vLbHDDWPRhT8CrpT63B/fffCKJH3g7lf6F4jEEodujuWK4NAMtij8GGzy/43Rq6Lo+769D5v5bvbW7fpQSVrmeDHiF6CmuFt3Be+vMQkVWbQz5+6a63QeppDIZ0CwNb/oVH/yVF3/S6jcdKIGMmrptgTNuYClRasMlBjl0iulKSO1pR8vQHx9kXgUscAMZE93aLe7jOZqBxI9gSVepjfE/Rv2BSMPZAabv3Xq5FKqdbjoPp6G/bvwaCAQiJl9a0iBwzCNbrM/1dadL/pbLidi3VARPF/CfSTnVdIZNVlrF6VjNoSZ1M/qNiZxdkDe0JEcDoRLWHgsCWv9W6OJizY42h/c4jO4guUwl+CdnZkwSdiVA8Ip6CC8OemyHdn5i3O4CwZPt72EboPu6M2GcbcLR3Yy9NMMgxrw/Hjo7w/4ruxs4QmilbGM0vtapTaeCL9mwIB+hNlIrLuFNwDZcDzDSNnvsJsR72b3ZY0h1tL2HTdQtJeC2bhsV5spSb4ejZz9vZfVPZ7T2odRFlDCINQn088NP3u1/3TZnNrUHXKzixffA+e/w+Fu7QHLECADDT+P1iQPRia0CFxE2uGpOnZm25MvoaBEtwxR91MXBH/1w0pCnDIogbc2BF0enkfcuu8XhZKXA1o7Cwu+3rGDptimFakcmePxt0zSqlO7jHzzdu9tYXcCABgm5l8D9iJ9AHe8tny3a2BDCHv6O2kRJdECBKgkSOV7KfHgeB/koqpse2GRZ+7xyrDKKgO4UU9jkLzq8N+xl7sXEzgFRNJgU6nhzR4N+IODnrrSrkm0T0gsOpUYMjJDEGWMXNENBomrcux1DzbZFJuByvkN7RRZ3N+c9BGUHtr+6XwpgsZmXS4iNPCfZ9OXjQeEINA6rACrEZh4axRU0AUVh33wrgOoyt5KqRZn9at0jZznTt9tBIkaF4EawoiOAA4ADcAMAAwADkAOQBjAGIAYQAzAGIANAA5ADcAMwAAABCAYBoMQQBkAG0AaQBuAAAAIhJBAFUAVgBRAFEAUgBSAEYAAAAqDG4AbwBuAGUAfAAAADImVwBpAG4AZABvAHcAcwAgADcAIABVAGwAdABpAG0AYQB0AGUAAABCNnwAQwBfAEYAXwAyADAANAA4ADUALwAyADYAMQA4ADQAMQB8AEQAXwBVAF8AMAAvADAAfAAAAEgAUEBYiQhgiQhoiQhw6pCwA3gQgAEBigEFMi4xLjE=
---END MAZE KEY---
|
| URLs |
http://aoacugmutagkwctu.onion/8870099cba3b4973 https://mazedecrypt.top/8870099cba3b4973 |
Signatures 11
Filter: none
Collection
Credential Access
Defense Evasion
Impact
-
Maze
Description
Ransomware family also known as ChaCha.
Tags
-
suricata: ET MALWARE Maze/ID Ransomware Activity
Description
suricata: ET MALWARE Maze/ID Ransomware Activity
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies extensions of user fileswordupd.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File renamed C:\Users\Admin\Pictures\PingInvoke.crw => C:\Users\Admin\Pictures\PingInvoke.crw.YXqFR0 wordupd.exe File renamed C:\Users\Admin\Pictures\StartInstall.crw => C:\Users\Admin\Pictures\StartInstall.crw.YXqFR0 wordupd.exe File renamed C:\Users\Admin\Pictures\UndoSync.crw => C:\Users\Admin\Pictures\UndoSync.crw.cSuYETk wordupd.exe File renamed C:\Users\Admin\Pictures\DebugGet.crw => C:\Users\Admin\Pictures\DebugGet.crw.uzDo1 wordupd.exe -
Drops startup filewordupd.exe
Reported IOCs
description ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8870099cba3b4973.tmp wordupd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt wordupd.exe -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Sets desktop wallpaper using registrywordupd.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" wordupd.exe -
Drops file in Program Files directorywordupd.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files\ExitRename.xps wordupd.exe File opened for modification C:\Program Files\FormatReset.m1v wordupd.exe File opened for modification C:\Program Files\HideConvertFrom.ttc wordupd.exe File opened for modification C:\Program Files\ResolveComplete.php wordupd.exe File opened for modification C:\Program Files\SearchResolve.wmv wordupd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt wordupd.exe File opened for modification C:\Program Files\PingProtect.docx wordupd.exe File opened for modification C:\Program Files\TestUnprotect.aiff wordupd.exe File opened for modification C:\Program Files\UnprotectExport.vdw wordupd.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt wordupd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\8870099cba3b4973.tmp wordupd.exe File opened for modification C:\Program Files\LockExit.dib wordupd.exe File opened for modification C:\Program Files\UnlockDeny.raw wordupd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt wordupd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\8870099cba3b4973.tmp wordupd.exe File opened for modification C:\Program Files\AssertUnlock.cmd wordupd.exe File opened for modification C:\Program Files\ConvertFromReset.midi wordupd.exe File opened for modification C:\Program Files\DenyPublish.mpeg3 wordupd.exe File opened for modification C:\Program Files\InvokePop.htm wordupd.exe File opened for modification C:\Program Files\JoinRemove.vdx wordupd.exe File opened for modification C:\Program Files\ReceiveEnable.txt wordupd.exe File opened for modification C:\Program Files\ResolveOpen.3gp2 wordupd.exe File opened for modification C:\Program Files\StepSet.vbe wordupd.exe File opened for modification C:\Program Files\SwitchLimit.vssx wordupd.exe File opened for modification C:\Program Files\TestWatch.dwfx wordupd.exe File opened for modification C:\Program Files\UndoInstall.sql wordupd.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt wordupd.exe File created C:\Program Files\DECRYPT-FILES.txt wordupd.exe File opened for modification C:\Program Files\8870099cba3b4973.tmp wordupd.exe File opened for modification C:\Program Files\ConfirmShow.css wordupd.exe File opened for modification C:\Program Files\EnterConfirm.mp3 wordupd.exe File opened for modification C:\Program Files\RestartConnect.rmi wordupd.exe File opened for modification C:\Program Files\SuspendDisconnect.vsdm wordupd.exe File opened for modification C:\Program Files (x86)\8870099cba3b4973.tmp wordupd.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\8870099cba3b4973.tmp wordupd.exe File opened for modification C:\Program Files\ConvertToHide.jfif wordupd.exe File opened for modification C:\Program Files\OutSelect.WTV wordupd.exe File opened for modification C:\Program Files\SubmitMeasure.vst wordupd.exe File opened for modification C:\Program Files\TestRestore.mpeg2 wordupd.exe File opened for modification C:\Program Files\ApproveDisable.dot wordupd.exe File opened for modification C:\Program Files\CompleteBlock.sql wordupd.exe -
Suspicious behavior: EnumeratesProcesseswordupd.exe
Reported IOCs
pid process 1464 wordupd.exe -
Suspicious use of AdjustPrivilegeTokenvssvc.exewmic.exeAUDIODG.EXEAUDIODG.EXE
Reported IOCs
description pid process Token: SeBackupPrivilege 1136 vssvc.exe Token: SeRestorePrivilege 1136 vssvc.exe Token: SeAuditPrivilege 1136 vssvc.exe Token: SeIncreaseQuotaPrivilege 1196 wmic.exe Token: SeSecurityPrivilege 1196 wmic.exe Token: SeTakeOwnershipPrivilege 1196 wmic.exe Token: SeLoadDriverPrivilege 1196 wmic.exe Token: SeSystemProfilePrivilege 1196 wmic.exe Token: SeSystemtimePrivilege 1196 wmic.exe Token: SeProfSingleProcessPrivilege 1196 wmic.exe Token: SeIncBasePriorityPrivilege 1196 wmic.exe Token: SeCreatePagefilePrivilege 1196 wmic.exe Token: SeBackupPrivilege 1196 wmic.exe Token: SeRestorePrivilege 1196 wmic.exe Token: SeShutdownPrivilege 1196 wmic.exe Token: SeDebugPrivilege 1196 wmic.exe Token: SeSystemEnvironmentPrivilege 1196 wmic.exe Token: SeRemoteShutdownPrivilege 1196 wmic.exe Token: SeUndockPrivilege 1196 wmic.exe Token: SeManageVolumePrivilege 1196 wmic.exe Token: 33 1196 wmic.exe Token: 34 1196 wmic.exe Token: 35 1196 wmic.exe Token: SeIncreaseQuotaPrivilege 1196 wmic.exe Token: SeSecurityPrivilege 1196 wmic.exe Token: SeTakeOwnershipPrivilege 1196 wmic.exe Token: SeLoadDriverPrivilege 1196 wmic.exe Token: SeSystemProfilePrivilege 1196 wmic.exe Token: SeSystemtimePrivilege 1196 wmic.exe Token: SeProfSingleProcessPrivilege 1196 wmic.exe Token: SeIncBasePriorityPrivilege 1196 wmic.exe Token: SeCreatePagefilePrivilege 1196 wmic.exe Token: SeBackupPrivilege 1196 wmic.exe Token: SeRestorePrivilege 1196 wmic.exe Token: SeShutdownPrivilege 1196 wmic.exe Token: SeDebugPrivilege 1196 wmic.exe Token: SeSystemEnvironmentPrivilege 1196 wmic.exe Token: SeRemoteShutdownPrivilege 1196 wmic.exe Token: SeUndockPrivilege 1196 wmic.exe Token: SeManageVolumePrivilege 1196 wmic.exe Token: 33 1196 wmic.exe Token: 34 1196 wmic.exe Token: 35 1196 wmic.exe Token: 33 2000 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2000 AUDIODG.EXE Token: 33 2000 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2000 AUDIODG.EXE Token: 33 1660 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1660 AUDIODG.EXE Token: 33 1660 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1660 AUDIODG.EXE -
Suspicious use of WriteProcessMemorywordupd.exe
Reported IOCs
description pid process target process PID 1464 wrote to memory of 1196 1464 wordupd.exe wmic.exe PID 1464 wrote to memory of 1196 1464 wordupd.exe wmic.exe PID 1464 wrote to memory of 1196 1464 wordupd.exe wmic.exe PID 1464 wrote to memory of 1196 1464 wordupd.exe wmic.exe
Processes 7
-
C:\Users\Admin\AppData\Local\Temp\wordupd.exePID:1464"C:\Users\Admin\AppData\Local\Temp\wordupd.exe"Modifies extensions of user filesDrops startup fileSets desktop wallpaper using registryDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\wmic.exePID:1196"C:\xsao\ec\..\..\Windows\lqq\ug\sjwm\..\..\..\system32\teg\cyc\kfd\..\..\..\wbem\jh\tbwth\w\..\..\..\wmic.exe" shadowcopy deleteSuspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exePID:1136C:\Windows\system32\vssvc.exeSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exePID:1564C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
-
C:\Windows\system32\AUDIODG.EXEPID:2000C:\Windows\system32\AUDIODG.EXE 0x1d0Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exePID:1572C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
-
C:\Windows\system32\AUDIODG.EXEPID:1660C:\Windows\system32\AUDIODG.EXE 0xc8Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
memory/1196-57-0x0000000000000000-mapping.dmp
-
memory/1464-54-0x0000000000230000-0x00000000002D1000-memory.dmp
-
memory/1464-55-0x00000000754A1000-0x00000000754A3000-memory.dmp
-
memory/1464-56-0x0000000000400000-0x00000000004BB000-memory.dmp
Title
Loading data