Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-02-2023 11:35
Static task
static1
Behavioral task
behavioral1
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
Resource
win10v2004-20221111-en
General
-
Target
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c550cb4f7a9b6fe
https://mazedecrypt.top/6c550cb4f7a9b6fe
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExitReceive.png => C:\Users\Admin\Pictures\ExitReceive.png.xg1omPv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\RepairReceive.tif => C:\Users\Admin\Pictures\RepairReceive.tif.UJIbZC8 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\SyncSet.tiff => C:\Users\Admin\Pictures\SyncSet.tiff.ZpgDeEr 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\TestPublish.tif => C:\Users\Admin\Pictures\TestPublish.tif.ZpgDeEr 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\TestUnlock.crw => C:\Users\Admin\Pictures\TestUnlock.crw.ZpgDeEr 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\EnableClose.tif => C:\Users\Admin\Pictures\EnableClose.tif.xg1omPv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\ExportComplete.png => C:\Users\Admin\Pictures\ExportComplete.png.xg1omPv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\FindLock.png => C:\Users\Admin\Pictures\FindLock.png.xg1omPv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\Pictures\HideExpand.tiff 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\HideExpand.tiff => C:\Users\Admin\Pictures\HideExpand.tiff.UJIbZC8 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\Pictures\SyncSet.tiff 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File renamed C:\Users\Admin\Pictures\DisableWatch.raw => C:\Users\Admin\Pictures\DisableWatch.raw.xg1omPv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c550cb4f7a9b6fe.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Drops file in Program Files directory 44 IoCs
description ioc Process File opened for modification C:\Program Files\EnterProtect.m4a 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ProtectDebug.eprtx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ResetRegister.htm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c550cb4f7a9b6fe.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\EnableDismount.xlsx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ReceiveUndo.wps 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RedoMount.pub 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RedoRead.pcx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c550cb4f7a9b6fe.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ExpandWrite.dot 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\CompleteUnregister.MTS 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\MountReceive.vsdm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SyncShow.jpg 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnblockFormat.wm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\CloseWatch.avi 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\ConnectNew.lock 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\FormatInvoke.3g2 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\HideResume.wmv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\MountUninstall.eprtx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RestartPush.ppsm 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SendOut.lock 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\SubmitUninstall.iso 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\CheckpointMount.xhtml 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c550cb4f7a9b6fe.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UpdateCompare.ppt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnprotectConnect.csv 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnprotectRename.mp4v 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\OutPop.eprtx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnregisterHide.ttc 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\RepairConfirm.css 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\6c550cb4f7a9b6fe.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\CompleteCheckpoint.ram 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\JoinProtect.M2T 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\MeasureProtect.MTS 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UnblockAssert.vssx 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File created C:\Program Files\DECRYPT-FILES.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\PopUninstall.txt 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\UndoStep.mp3 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files (x86)\6c550cb4f7a9b6fe.tmp 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe File opened for modification C:\Program Files\GroupConfirm.ps1 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1652 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeBackupPrivilege 1780 vssvc.exe Token: SeRestorePrivilege 1780 vssvc.exe Token: SeAuditPrivilege 1780 vssvc.exe Token: SeIncreaseQuotaPrivilege 1948 wmic.exe Token: SeSecurityPrivilege 1948 wmic.exe Token: SeTakeOwnershipPrivilege 1948 wmic.exe Token: SeLoadDriverPrivilege 1948 wmic.exe Token: SeSystemProfilePrivilege 1948 wmic.exe Token: SeSystemtimePrivilege 1948 wmic.exe Token: SeProfSingleProcessPrivilege 1948 wmic.exe Token: SeIncBasePriorityPrivilege 1948 wmic.exe Token: SeCreatePagefilePrivilege 1948 wmic.exe Token: SeBackupPrivilege 1948 wmic.exe Token: SeRestorePrivilege 1948 wmic.exe Token: SeShutdownPrivilege 1948 wmic.exe Token: SeDebugPrivilege 1948 wmic.exe Token: SeSystemEnvironmentPrivilege 1948 wmic.exe Token: SeRemoteShutdownPrivilege 1948 wmic.exe Token: SeUndockPrivilege 1948 wmic.exe Token: SeManageVolumePrivilege 1948 wmic.exe Token: 33 1948 wmic.exe Token: 34 1948 wmic.exe Token: 35 1948 wmic.exe Token: SeIncreaseQuotaPrivilege 1948 wmic.exe Token: SeSecurityPrivilege 1948 wmic.exe Token: SeTakeOwnershipPrivilege 1948 wmic.exe Token: SeLoadDriverPrivilege 1948 wmic.exe Token: SeSystemProfilePrivilege 1948 wmic.exe Token: SeSystemtimePrivilege 1948 wmic.exe Token: SeProfSingleProcessPrivilege 1948 wmic.exe Token: SeIncBasePriorityPrivilege 1948 wmic.exe Token: SeCreatePagefilePrivilege 1948 wmic.exe Token: SeBackupPrivilege 1948 wmic.exe Token: SeRestorePrivilege 1948 wmic.exe Token: SeShutdownPrivilege 1948 wmic.exe Token: SeDebugPrivilege 1948 wmic.exe Token: SeSystemEnvironmentPrivilege 1948 wmic.exe Token: SeRemoteShutdownPrivilege 1948 wmic.exe Token: SeUndockPrivilege 1948 wmic.exe Token: SeManageVolumePrivilege 1948 wmic.exe Token: 33 1948 wmic.exe Token: 34 1948 wmic.exe Token: 35 1948 wmic.exe Token: 33 1072 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1072 AUDIODG.EXE Token: 33 1072 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1072 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1948 1652 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 33 PID 1652 wrote to memory of 1948 1652 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 33 PID 1652 wrote to memory of 1948 1652 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 33 PID 1652 wrote to memory of 1948 1652 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"C:\Users\Admin\AppData\Local\Temp\4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\wbem\wmic.exe"C:\ckyk\wav\uc\..\..\..\Windows\h\aedll\ynkn\..\..\..\system32\mlky\rvpcq\kxjx\..\..\..\wbem\gv\iey\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1828
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1072