Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-02-2023 11:24
Static task
static1
Behavioral task
behavioral1
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Score
10/10
Malware Config
Extracted
Path
C:\DECRYPT-FILES.txt
Family
maze
Ransom Note
Attention!
----------------------------
| What happened?
----------------------------
We hacked your network and now all your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms.
You cannot access the files right now. But do not worry. You can get it back! It is easy to recover in a few steps.
We have also downloaded a lot of private data from your network, so in case of not contacting us as soon as possible this data will be released.
If you do not contact us in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info.
To see what happens to those who don't contact us, google:
* Southwire Maze Ransomware
* MDLab Maze Ransomware
* City of Pensacola Maze Ransomware
After the payment the data will be removed from our disks and decryptor will be given to you, so you can restore all your files.
----------------------------
| How to contact us and get my files back?
----------------------------
The only method to restore your files and be safe from data leakage is to purchase a unique for you private key which is securely stored on our servers.
To contact us and purchase the key you have to visit our website in a hidden TOR network.
There are general 2 ways to reach us:
1) [Recommended] Using hidden TOR network.
a) Download a special TOR browser: https://www.torproject.org/
b) Install the TOR Browser.
c) Open the TOR Browser.
d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/6cc30cc3a534c1ad
e) Follow the instructions on this page.
2) If you have any problems connecting or using TOR network
a) Open our website: https://mazedecrypt.top/6cc30cc3a534c1ad
b) Follow the instructions on this page.
Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use.
On this page, you will see instructions on how to make a free decryption test and how to pay.
Also it has a live chat with our operators and support team.
----------------------------
| What about guarantees?
----------------------------
We understand your stress and worry.
So you have a FREE opportunity to test a service by instantly decrypting for free three files from every system in your network.
If you have any problems our friendly support team is always here to assist you in a live chat!
P.S. Dear system administrators, do not think you can handle it by yourself. Inform leadership as soon as possible.
By hiding the fact of the breach you will be eventually fired and sometimes even sued.
-------------------------------------------------------------------------------
THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU
---BEGIN MAZE KEY---
v5Ais/1/QU7NNvF+IEkcHeGAfg5dzTWsKoQrj4YeA+jtXdwNn6DfY+AcD46cLueC+gAdpwOWBtZdNleuefe3ArPGg3+YLayXs4CmMF0JhlCxHRwqZpB1AsMRJ/tICwhBuhOLRzoGQRraZwP2ZM4QTq0TRImJjJjm7RWe9hw/LHHy+bfC2Mt03G+6ZN7KhgBLmlJiizJEcM51ZFvLhpZa8el+QBVbNmIUHjUrXUVLnnPmPqz3BDU87PJXnyIBKX7ExKrxwp5gZkPJ8T6HPs4PqzXmNA5B9eNPlEQbjLEjNf4WFpRmzEHMo/oqsSe8zSpNGrbk+G0TBi0Bl3zGhQWlK+9PrJUGGtEXEjzcbay1KZISwJYcq67WNLLYYxs6PXx9YbUtq7/SV0s0WlmerxKxNk5/DeL8J59ZQqQ/gvS6hfuvrq4RfmyXPqJAvXx7rzDDcWh0c6DSQlE72c+a+iQMZO0BZI7fUW4rOawFckwrm9QLTJafBonqJIT+VjjE+MZJiJEX+QrzdZUeO4ezTTfZNYZ/xDuPuK7wdOQ9i5Lm2tQXNhWSqOZiuqdT7m3HAzyxAMDDz0J/bRwliJIMPzIjG/SHeB6sfYkKJcaWq1yeL4mmvBP/BdIlV1nuqoDWMbbR6DBeinAUgt2nQRBEXE2tPWPpBCh/rXUCBhZ91pdPdhw45QElsmpEjfruu8QQgYnaAc4Nkv0Sgv6wH7Ww1omPhZM6ms0wDu+ZW/2PkmfIYI1cE+a01OvaDydbtRspqkSA+vSmcv8QRyyS/VX1XcO0egypEA1/Xq/LSnNfRp9D2ff8MBntnLkn7UJWkXfeQnC6vN3Fs1pgr8zHboXDvvchsNzShI1qgbAccI9V6j6cPIymP7gHWThlRJu6s55gvVtAe25PzzXWgFGGgjwL1nx1smEWPngv/onhSnYywMsWOjBeXGrX5tihv3jbJUPGbB2GMKOsHeDOqD27dKDM5ZPTYPCtB0vy+ueU1tgI1W6ffy+uLyMG5zx9k0enPJIW1WPiMscH5+sZU+9mDpz1+xIbEwg7wpkl1PX3yLSrODbGJ8XP7MJyu4JYshUyi+qm/bQa/7HW262/IDHd5wkXXMpb+RJtu1CXAiQfWHmBmUDg10Sf+UYF1B4gIMJZgsY87mNRZpE03r9rPXdmm++LmfLRCZdzkkh9Gk/snfSsXyC38bMgS28tec6tM6jvik+C+eXxcZo9HGSWRH3oHHU74qc6wojsmQdr5dIZNCuiTt//+ujSsWLnyX8WuHt+Ua7mr0mdkScI+/WbRgHClXa+iKLQ7awipWP7Sa03ORnj0nf90uiArG/6aFE9M+h05yyjINCGQPh9WHWiK2HMRs+4rBVyFCFR75cvMaoxwF/Hfy4PKI2tmGhmfZkHcez780Q5vi3FjjCJZ497sL7aHJQDLv/YCpAhwei+cDT3SdamSEKbVHDd2nJTYYdPWScBHZUS2OVWJmFk5bU3rdQ1UG/BtTKg+vrx6bCagEY264Ze+qouHMQBBQlFEthMmVWX8vHGMqewqsgVI6NXbBn9Rdyph29wOLWBbtC4rfAI/fRxMuBwxO8BqlWoxCxuOySp4Bcnaoy1V33jHlkl/cgiSFckOrr0rIy5/BQtvnI9C29FvQtz29wqoUmRdeJiCmjJm1q1tg6iFMd6iyGmSXf6Dmb1YUaGyiWKGcHXGgv39d4jQZ2sj6yvaaKPsAlC/22hoL9tbV/XcTwBxpzpagAVN2nesn2M1a74GQSCwpNIkhKfQ2St9jbYVoMmFPj0svqIIV1+ind0LlrbLBE0T6Y0Zr1I4A324aGJWokIVbj41rlYARoPf+YtmAcufiqE0hzIU6a4vdphVfEAuzDdy0oQyY2HqNLCubrIBwdkeyA0WUIfU3Xv98EhjrAzqD6grUASEVelVLM0oMNhg5PBBDoaasyY8HoqPFC53wuy3T0K2zJOqLZXmanrqPo2g4K7SoLyFWeod9fJWrMSm/si39fdZCjU/MfXQuOn9i+ijKd+H+JkHyOw5pNXAa8o10EkKosNkcfyhYT4GJgNLXhuHPgi1R9t9/JPevT8CSb3mTsjTc5QuAJ79VBCjuQj8MLI6HYGFIBhmNnJtxiCfq3vc5sqDRcUhzSuLMWCGjvVOZ7Gv8eJ6MPtElYMkcxR6We7LNHKBRGzEAcKe/7McAJVRVx4zRSQg9pr9NReH5eYBg3NPlg5hQPzsnm2UlOwaqkobgUiXDIWeIaXdkMTBQoiNgBjAGMAMwAwAGMAYwAzAGEANQAzADQAYwAxAGEAZAAAABCAYBoMQQBkAG0AaQBuAAAAIiZXAE8AUgBLAEcAUgBPAFUAUABcAE8AUgBYAEcASwBLAFoAQwAAACoMbgBvAG4AZQB8AAAAMiZXAGkAbgBkAG8AdwBzACAANwAgAFUAbAB0AGkAbQBhAHQAZQAAADoofABkAGUAcAByAGUAYwBhAHQAZQBkACAAPgAgAHYAMgAuADMAfAAAAEI2fABDAF8ARgBfADIAMAA0ADgAMAAvADIANgAxADgANAAxAHwARABfAFUAXwAwAC8AMAB8AAAASABQQFiJCGCJCGiJCHCpgbEDeAyAAQGKAQUyLjMuMQ==
---END MAZE KEY---
URLs
http://aoacugmutagkwctu.onion/6cc30cc3a534c1ad
https://mazedecrypt.top/6cc30cc3a534c1ad
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SelectRead.png => C:\Users\Admin\Pictures\SelectRead.png.mCh5tp7 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\MountGet.crw => C:\Users\Admin\Pictures\MountGet.crw.fVOHX91 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\Pictures\PopReceive.tiff 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\PopReceive.tiff => C:\Users\Admin\Pictures\PopReceive.tiff.mCh5tp7 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6cc30cc3a534c1ad.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops file in Program Files directory 41 IoCs
description ioc Process File opened for modification C:\Program Files\InitializeComplete.midi 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\InitializeInstall.aiff 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\TestRestore.htm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\BlockCopy.jtx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\InvokeStep.m1v 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RedoWrite.jpe 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6cc30cc3a534c1ad.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnlockStep.zip 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\6cc30cc3a534c1ad.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\DebugConvert.emf 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\LockEnable.m4v 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ProtectUninstall.vstx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\PushApprove.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\DisconnectSync.dot 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\PublishSave.css 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\StepWrite.png 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ResumeDeny.doc 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SwitchLock.reg 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ExitJoin.mpeg2 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\GrantSkip.asf 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\MergePublish.hta 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ProtectUninstall.ram 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6cc30cc3a534c1ad.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\CompleteUnregister.cr2 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\FindUnlock.au 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\TestConvertTo.M2T 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RequestMount.wma 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RestartWait.WTV 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\TraceClear.lock 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnpublishConvertTo.tif 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\WaitGet.mpp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\6cc30cc3a534c1ad.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\GroupJoin.mp2 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\MountResume.rtf 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\NewReset.odt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6cc30cc3a534c1ad.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\jt1CIl4_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.jt1CIl4 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.jt1CIl4\ = "jt1CIl4_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\jt1CIl4_auto_file\shell\open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\jt1CIl4_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\jt1CIl4_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\jt1CIl4_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\jt1CIl4_auto_file\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1720 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeBackupPrivilege 648 vssvc.exe Token: SeRestorePrivilege 648 vssvc.exe Token: SeAuditPrivilege 648 vssvc.exe Token: SeIncreaseQuotaPrivilege 1188 wmic.exe Token: SeSecurityPrivilege 1188 wmic.exe Token: SeTakeOwnershipPrivilege 1188 wmic.exe Token: SeLoadDriverPrivilege 1188 wmic.exe Token: SeSystemProfilePrivilege 1188 wmic.exe Token: SeSystemtimePrivilege 1188 wmic.exe Token: SeProfSingleProcessPrivilege 1188 wmic.exe Token: SeIncBasePriorityPrivilege 1188 wmic.exe Token: SeCreatePagefilePrivilege 1188 wmic.exe Token: SeBackupPrivilege 1188 wmic.exe Token: SeRestorePrivilege 1188 wmic.exe Token: SeShutdownPrivilege 1188 wmic.exe Token: SeDebugPrivilege 1188 wmic.exe Token: SeSystemEnvironmentPrivilege 1188 wmic.exe Token: SeRemoteShutdownPrivilege 1188 wmic.exe Token: SeUndockPrivilege 1188 wmic.exe Token: SeManageVolumePrivilege 1188 wmic.exe Token: 33 1188 wmic.exe Token: 34 1188 wmic.exe Token: 35 1188 wmic.exe Token: SeIncreaseQuotaPrivilege 1188 wmic.exe Token: SeSecurityPrivilege 1188 wmic.exe Token: SeTakeOwnershipPrivilege 1188 wmic.exe Token: SeLoadDriverPrivilege 1188 wmic.exe Token: SeSystemProfilePrivilege 1188 wmic.exe Token: SeSystemtimePrivilege 1188 wmic.exe Token: SeProfSingleProcessPrivilege 1188 wmic.exe Token: SeIncBasePriorityPrivilege 1188 wmic.exe Token: SeCreatePagefilePrivilege 1188 wmic.exe Token: SeBackupPrivilege 1188 wmic.exe Token: SeRestorePrivilege 1188 wmic.exe Token: SeShutdownPrivilege 1188 wmic.exe Token: SeDebugPrivilege 1188 wmic.exe Token: SeSystemEnvironmentPrivilege 1188 wmic.exe Token: SeRemoteShutdownPrivilege 1188 wmic.exe Token: SeUndockPrivilege 1188 wmic.exe Token: SeManageVolumePrivilege 1188 wmic.exe Token: 33 1188 wmic.exe Token: 34 1188 wmic.exe Token: 35 1188 wmic.exe Token: 33 1236 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1236 AUDIODG.EXE Token: 33 1236 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1236 AUDIODG.EXE Token: SeDebugPrivilege 224 firefox.exe Token: SeDebugPrivilege 224 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 224 firefox.exe 224 firefox.exe 224 firefox.exe 224 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 224 firefox.exe 224 firefox.exe 224 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1188 1720 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 32 PID 1720 wrote to memory of 1188 1720 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 32 PID 1720 wrote to memory of 1188 1720 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 32 PID 1720 wrote to memory of 1188 1720 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 32 PID 1536 wrote to memory of 1156 1536 rundll32.exe 37 PID 1536 wrote to memory of 1156 1536 rundll32.exe 37 PID 1536 wrote to memory of 1156 1536 rundll32.exe 37 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 1156 wrote to memory of 224 1156 firefox.exe 38 PID 224 wrote to memory of 1608 224 firefox.exe 40 PID 224 wrote to memory of 1608 224 firefox.exe 40 PID 224 wrote to memory of 1608 224 firefox.exe 40 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41 PID 224 wrote to memory of 208 224 firefox.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\wbem\wmic.exe"C:\h\..\Windows\enbh\nniu\..\..\system32\nwf\sch\..\..\wbem\ug\laf\bs\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:648
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:972
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4e41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SwitchClear.css.jt1CIl41⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\SwitchClear.css.jt1CIl4"2⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -url C:\Users\Admin\Desktop\SwitchClear.css.jt1CIl43⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.0.89696998\922366129" -parentBuildID 20200403170909 -prefsHandle 1476 -prefMapHandle 1252 -prefsLen 1 -prefMapSize 215966 -appdir "C:\Program Files\Mozilla Firefox\browser" - 224 "\\.\pipe\gecko-crash-server-pipe.224" 1216 gpu4⤵PID:1608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.6.1396584644\716256779" -childID 1 -isForBrowser -prefsHandle 1812 -prefMapHandle 1808 -prefsLen 1138 -prefMapSize 215966 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 224 "\\.\pipe\gecko-crash-server-pipe.224" 1916 tab4⤵PID:208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.13.518744384\1021619839" -childID 2 -isForBrowser -prefsHandle 1876 -prefMapHandle 1872 -prefsLen 1172 -prefMapSize 215966 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 224 "\\.\pipe\gecko-crash-server-pipe.224" 2208 tab4⤵PID:2108
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.20.1076030175\1814424290" -childID 3 -isForBrowser -prefsHandle 5620 -prefMapHandle 5616 -prefsLen 1508 -prefMapSize 215966 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 224 "\\.\pipe\gecko-crash-server-pipe.224" 5632 tab4⤵PID:3088
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD507ee80612a5ce9ab526cfa29c9c0d2d0
SHA193919668076513d9c7fd4c6e646d39da0f4f2096
SHA25639152c75bcefaa460c3501b3999461054eaab4f6f7aec37c5a7336760219ecd8
SHA51274b5d511e5ec2bde3a7f31f917c890b260204549cfc121b9deec0a0f2cee298d32cad01bc2a29695ec02cb11f20d0227ede9fa0f547ecae1399fec709ee78ba9
-
Filesize
304KB
MD5cc8c1ae2b1edd55518d6353e1725eaa6
SHA1ac7918fb1acd7688c0c4d5e92ea7118e8d638535
SHA256a71bcdf8c96da5282a6240bd0018ac99309ad821c67bdf5b9047051b8063b196
SHA5129740c569bb230c00ea854fba5a1b97234e716f4aa2cce41bcf47ff16919123fe0be6eb6bc55a7d263fa892b66808548a47987995762331d75e7f2b2d1e1f429a