6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-03-2023 04:18

Sharing

Report Analysis Logs

General

Target

MazeRansomware.bin.exe
Size

478KB
MD5

deebbea18401e8b5e83c410c6d3a8b4e
SHA1

96d81e77b6af8f54a5ac07b2c613a5655dd05353
SHA256

6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
SHA512

a0396c82fb68cf3931f0a2fcdba580d51ec6069c82b4e3853341fc6971a4bde4dbeb0094b94379d1dce4b1d8c43703e86266156ecbee89f9c939a71cafe9d487
SSDEEP

12288:2GOrdqXg+Hy7WxHXkzYHD9Fg0CNDG+X9MOguRTzxH/F:EjuSWxHY0C5PXmOgEhN

Score

8^/10

Malware Config

Signatures

Windows Defender anti-emulation file check 1 TTPs 1 IoCs
Defender's emulator always creates certain fake files which can be used to detect it.

System Information Discovery
T1082

Processes:

MazeRansomware.bin.exe

description ioc process

File opened (read-only) C:\aaa_TouchMeNot_.txt MazeRansomware.bin.exe

C:\Users\Admin\AppData\Local\Temp\MazeRansomware.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MazeRansomware.bin.exe"
1⤵
- Windows Defender anti-emulation file check
PID:1976

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...