Analysis
-
max time kernel
726s -
max time network
754s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2023 12:55
Static task
static1
Behavioral task
behavioral1
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win10v2004-20221111-en
General
-
Target
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6bed0cae4b2c7b91
https://mazedecrypt.top/6bed0cae4b2c7b91
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\OpenLimit.tiff => C:\Users\Admin\Pictures\OpenLimit.tiff.OiIX 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\AddConvertFrom.tif => C:\Users\Admin\Pictures\AddConvertFrom.tif.YkhuiMx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\CopyClose.tif => C:\Users\Admin\Pictures\CopyClose.tif.LjEcWqQ 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\DenyOut.png => C:\Users\Admin\Pictures\DenyOut.png.LjEcWqQ 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\Pictures\OpenLimit.tiff 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\TestSave.raw => C:\Users\Admin\Pictures\TestSave.raw.XAg0Z 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\DisableAdd.png => C:\Users\Admin\Pictures\DisableAdd.png.LjEcWqQ 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\RequestUnregister.crw => C:\Users\Admin\Pictures\RequestUnregister.crw.XAg0Z 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\ResetJoin.png => C:\Users\Admin\Pictures\ResetJoin.png.XAg0Z 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\SendDebug.tif => C:\Users\Admin\Pictures\SendDebug.tif.XAg0Z 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6bed0cae4b2c7b91.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6bed0cae4b2c7b91.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 38 IoCs
description ioc Process File opened for modification C:\Program Files\HideLock.mid 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ImportExit.ppsx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\InvokeCopy.xltm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RestoreInstall.wav 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SubmitUnprotect.tif 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\DenySwitch.ttf 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RedoBackup.DVR 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RepairCheckpoint.eps 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ResizeConfirm.vstm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SelectExport.dwfx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SubmitOut.jpeg 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ResolveGet.rm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnregisterWatch.xps 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UpdateEnable.pub 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\BackupShow.wmv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ConnectEnable.mp4 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\JoinSplit.bat 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SearchOpen.docx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SendReset.3gpp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SwitchOpen.asf 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\AddPush.mpeg3 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\CompressImport.wma 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\EnterPing.jfif 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\PingDisable.asx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnpublishResume.bmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\AssertClose.DVR-MS 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\HideEdit.3gp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\InvokeDisable.vsd 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\6bed0cae4b2c7b91.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\InitializeDisable.TS 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\JoinReset.wmx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ResizeSave.xps 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\CloseSearch.wmv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SwitchCopy.vsw 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnlockAssert.ico 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\6bed0cae4b2c7b91.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3664 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 3664 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeBackupPrivilege 3584 vssvc.exe Token: SeRestorePrivilege 3584 vssvc.exe Token: SeAuditPrivilege 3584 vssvc.exe Token: SeBackupPrivilege 3652 vssvc.exe Token: SeRestorePrivilege 3652 vssvc.exe Token: SeAuditPrivilege 3652 vssvc.exe Token: SeIncreaseQuotaPrivilege 3092 wmic.exe Token: SeSecurityPrivilege 3092 wmic.exe Token: SeTakeOwnershipPrivilege 3092 wmic.exe Token: SeLoadDriverPrivilege 3092 wmic.exe Token: SeSystemProfilePrivilege 3092 wmic.exe Token: SeSystemtimePrivilege 3092 wmic.exe Token: SeProfSingleProcessPrivilege 3092 wmic.exe Token: SeIncBasePriorityPrivilege 3092 wmic.exe Token: SeCreatePagefilePrivilege 3092 wmic.exe Token: SeBackupPrivilege 3092 wmic.exe Token: SeRestorePrivilege 3092 wmic.exe Token: SeShutdownPrivilege 3092 wmic.exe Token: SeDebugPrivilege 3092 wmic.exe Token: SeSystemEnvironmentPrivilege 3092 wmic.exe Token: SeRemoteShutdownPrivilege 3092 wmic.exe Token: SeUndockPrivilege 3092 wmic.exe Token: SeManageVolumePrivilege 3092 wmic.exe Token: 33 3092 wmic.exe Token: 34 3092 wmic.exe Token: 35 3092 wmic.exe Token: 36 3092 wmic.exe Token: SeIncreaseQuotaPrivilege 3092 wmic.exe Token: SeSecurityPrivilege 3092 wmic.exe Token: SeTakeOwnershipPrivilege 3092 wmic.exe Token: SeLoadDriverPrivilege 3092 wmic.exe Token: SeSystemProfilePrivilege 3092 wmic.exe Token: SeSystemtimePrivilege 3092 wmic.exe Token: SeProfSingleProcessPrivilege 3092 wmic.exe Token: SeIncBasePriorityPrivilege 3092 wmic.exe Token: SeCreatePagefilePrivilege 3092 wmic.exe Token: SeBackupPrivilege 3092 wmic.exe Token: SeRestorePrivilege 3092 wmic.exe Token: SeShutdownPrivilege 3092 wmic.exe Token: SeDebugPrivilege 3092 wmic.exe Token: SeSystemEnvironmentPrivilege 3092 wmic.exe Token: SeRemoteShutdownPrivilege 3092 wmic.exe Token: SeUndockPrivilege 3092 wmic.exe Token: SeManageVolumePrivilege 3092 wmic.exe Token: 33 3092 wmic.exe Token: 34 3092 wmic.exe Token: 35 3092 wmic.exe Token: 36 3092 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3664 wrote to memory of 3092 3664 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 86 PID 3664 wrote to memory of 3092 3664 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\system32\wbem\wmic.exe"C:\mo\aeja\mj\..\..\..\Windows\dmw\onp\..\..\system32\uhs\..\wbem\ma\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652