maze | 77b2731ff3c7a14b8b962ea387c41293415b3478e73973888851991105777560

Analysis

max time kernel
136s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-04-2023 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Size

473KB
MD5

f83fb9ce6a83da58b20685c1d7e1e546
SHA1

01c459b549c1c2a68208d38d4ba5e36d29212a4f
SHA256

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
SHA512

934ec9073a28b90e8df785bef49f224789da59f83729208b92dba0503e2894b3f48ed04b20de1ba49374b1cd26f0c87e8e5ab79e817258135e3be2c171f3f396
SSDEEP

12288:v6l/7FpnaeoQbRLBYdunMCayql4YcQD+AgJbAWgjbgpQ:CDna43YAKl4Yci+AggEpQ

Score

10^/10

maze ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\MSOCache\DECRYPT-FILES.html

Ransom Note

<html> <head> <script> function CopyToClipboard(containerid) { if (document.selection) { var range = document.body.createTextRange(); range.moveToElementText(document.getElementById(containerid)); range.select().createTextRange(); document.execCommand("copy"); } else if (window.getSelection) { var range = document.createRange(); range.selectNode(document.getElementById(containerid)); window.getSelection().addRange(range); document.execCommand("copy"); alert("Base64 copied into the clipboard!") } } </script> <style> html{ margin:0; padding:0; width:100%; height:100%; } body { background: #000000; color: #ececec; font-family: Consolas }; .tooltip { position: relative; display: inline-block; border-bottom: 1px dotted black; } .tooltip .tooltiptext { visibility: hidden; width: 120px; background-color: #555; color: #fff; text-align: center; border-radius: 6px; padding: 5 px 0; position: absolute; z-index: 1; bottom: 125%; left: 50%; margin-left: -60px; opacity: 0; transition: opacity 0.3s; } .tooltip .tooltiptext::after { content: ""; position: absolute; top: 100%; left: 50%; margin-left: -5px; border-width: 5px; border-style: solid; border-color: #555 transparent transparent transparent; } .tooltip:hover .tooltiptext { visibility: visible; opacity: 1; } p#base64{ -ms-word-break: break-all; word-break: break-all; -webkit-hyphens: auto; -moz-hyphens: auto; -ms-hyphens: auto; hyphens: auto; } p#base64:hover{ cursor: hand; } </style> </head> <body> <table style="position: absolute;" width="100%"> <tr> <td style="width: 25%;"> <td style="width: 50%;"> <div style="text-align: center; font-size: 20px;"> <p><b>Maze ransomware</b></p> <p>*********************************************************************************************************************</p> <p>Attention! Your documents, photos, databases, and other important files have been encrypted!</p> <p>*********************************************************************************************************************</p> </div> <div style="text-align: center; font-size: 18px;"> <p><b>What is going on?</b><br>Your files have been encrypted using strong reliable algorithms RSA-2048 and ChaCha20 with an unique private key for your system</p> <p>You can read more about this cryptosystem here: <a href=https://en.wikipedia.org/wiki/RSA_(cryptosystem)>https://en.wikipedia.org/wiki/RSA_(cryptosystem)</a></p> <p>The only way to recover (decrypt) your files is to buy decryptor with the unique private key</p> <p><u>Attention! Only we can recover your files! If someone tell you that he can do this, kindly ask him to proof!</u></p> <p>By us you can decrypt one of your files for free as a proof of work that we have the method to decrypt the rest of your data.</p> <p>In order to either buy the private key or make test decryption contact us via email: <br> <u><b>Main e-mail: [email protected]<br>Reserve e-mail: [email protected]</b></u> <p>Remember to hurry up as email address may not be available for very long as soon as law enforcements of different countries always trying to seize emails used in ransom companies <p>If you are willing to pay but you are not sure knock us and we will save your e-mail address. In case the listed addresses are seized we will write you from the new one</p> <p>Below you will see a big base64 blob, you will need to email us and copy this blob to us.<br>you can click on it, and it will be copied into the clipboard.</p> <p>If you have troubles copying it, just send us the file you are currently reading, as an attachment.</p> <p>Base64: </p> </div><div style="text-align: center; font-size: 12px;"><p id="base64" onclick="return CopyToClipboard('base64')" class="tooltip">Dj41/vXIR1jjiE7mUsCwZDiYj0FLeCzR/vWdY0p63Ckt7UvJtmHkQpn9Gn0ZnGUfRbYYtI61cOCu6MlSxPZI+8Z6Mc09Q1mi0PIuDRAjlLsK/ORxP6ofl0w60RMvfREbUNDNQncFn/Rd2PwKCQyrqvrStr62rSga5u1cNwyRfmFDt/J9+wy+XnSy8bPFdo0xtoLRI7zHYrGUVydu6PPmSksvkhi5jy8LwRkkeGKC3l4QsZmVfRYBTbPXMr6GDznC6WyQZ9ENMhfBO9Be+Mi8zOGg4Au1N88QaaywuX+rbxbOWzf8oTP99taP0ZQSKmFAhPb3VJhYn2A4wFqYG0O1mTwuFxT8bBj13BnORUeTA1N72c6qfKB58KMal2YBcwplQtIuRx2LDUVpSQGcJFPMElc6ZjWU+F4EvsuckjoG3xVbHT7UZS/D6C7dVqIKHxbd7iRzMsS7M4wcyU3UGkMsTzdmVaIGne7IFkHxCLPIJSpNeUyK0SqFrsCiFoobJyX5uVyoXqQBo265zKuLFlU3fcWtuHKIKXvQoKdkvKCs4jydLJHFkWGwCtEKh7PLJDKqr/IyKknZZ+GJkaXEMmpekrGxTsUZRgFYtTe/tzBLOrpeTW3v19F9nwGyZYma8rXvlw5CePwHj/eLdHm5Wr64gWDDSJiGhtelXDWuBP4/02cPG89jsBFM1WtPThZ5C97cs9BokSfgEaaKU5ecEkn7/xMi+WN599P4tFFLccXsR1n8mElKjtjPwuR1zn3bbfMTpH5BvPIZ/2nrtehbplSXxIoiYFbq+NJjNIsXf10tK7htkmPBkxYKefYjxMZYyffQXCldecPXx5KjeYyReHrpcmRgHCsf4rkhedC82I5Gn33J4B/MWvlCVbCgyyieXxgmUOgThEitGKpZwhrckkzvTDWQWy21fjjN1DiPILJxxyWEJg73DMlKD0PL3f3U5XvsnZU6iuvdPWbao/Dmb84nUF61bsgVGiIg5BW2Xt+lXusO0xLz74xkL6n2mqe9JE2GhIVcD3YF5OIQBnJNxpW3mAq667GDynKYhEgrOmTumTQOt/IaxBN0hS+rI10gr/pj2OTTkyJU41aAwXdi+JXJcnq53iNYSpJBZ0eLN+LawmG2BJbI65vWFKic4PduyZkdu3RNw+D1m27hk0AFM2DIr+suxkC2NCiagMKiZcEmEN3a6+mMWH+bd+7xsKlET4GP+vCEQuWd6yjuutVDeu28oatVCIedUbSEH5tMUxymz/6byBZWjxth8phc8M8leyI5ciEC+kOfvE7BvtAJidUGuyyzRSoacyBXEqDHpclUW54i60ZDPi2JrZTMlgflgjVCt4QtoqVZWFPO0r6KJxzMIkQpabw3hiO4aqY/bew7+e64VINURIeVnKI4t0C92xYPx6pKlpY0EaDp0MObQpVnAjt1lKkjQ1IdLDMCrKh6+0/LztWN7tXMi3HDaZR9Cap8XVvXdJzUx0vdwgKwzkTmedPN48P6stLDSG4wiw+ZfXPin6veIRtg4M7rRanujdbYskbhgU3xDQGKeXD/hQFd8OKKv2yp2T9Z3a2YVL6x+G/QRg0vfNHeOz3j1FrUeL9VMDBGiH6equqKLVYY/udC+XylfHVdZoUq1GYuR1GFNgYfmLpVLibAzxc6y8vTIz4i90AYUylf6S+ZWC7YK/WoXHHz05QHW3syF4sU+mfKcKauL6HwMxsaE5JscYk2S26Ijxjp8SZVU0ThujBNc5yJmtuvpUJPFKooEYZXoVM9xpzEJWxZa90Aj5V5ZQ80OGr2V05Drk57qoxVaeXdi+AtDA92kwCWgP2ciYmKFYKAFW/bVSIOz6XBpdzhYXh1Io0mN83aFA6LkGhO9ayPNFPYdX3GSCb3wZwqAz9IYOSce+p3evul0Wz1gQMaLXbOXy8/gnt0GwHAiZ7L4h24WntUWTiW92Lw7Raxmuj4zjZ5sWVKj1fTeUwW34k+f92vdLnpB9sRVQv/UJwkAjk/Jh95+Cjae2NOISdWmndfuT4fhArrGQafTqItUAeqX1UFYZOrY0hV+XEbODJ+feZjQO1DoqI2FNBIlHVB3TDEx5AphV9fMBInKUbR9UQ90ZOm+vuMUWgW8lC+TMT2kGGNL0WlbpcnwtBwabe0/D+ifiGObtqfs9VIQoU2J+QgGodJBpP30XRjPBPzN055GKfKLaqtRtqG9uiLnWVPW6qgJzLFivmFcewi4RPTDqV3i3Pfe4vdzorehAoiOAA4ADEAMAAwADkAOABhAGQAOAAzADQANQA1ADgAMQAAABCAYBoMQQBkAG0AaQBuAAAAIhJNAEwAWABMAEYASwBPAEkAAAAqDG4AbwBuAGUAfAAAADImVwBpAG4AZABvAHcAcwAgADcAIABVAGwAdABpAG0AYQB0AGUAAABCNnwAQwBfAEYAXwAyADAANAA4ADUALwAyADYAMQA4ADQAMQB8AEQAXwBVAF8AMAAvADAAfAAAAEgAUEBYiQhgiQhoiQhw1OqwA3gDgAECigEFMS4wLjI=<span class="tooltiptext">Click here to copy</span></p></div></td><td style="width: 25%; text-align: right;"></tr></table></body></html>

Emails

[email protected]<br>Reserve

[email protected]</b></u>

Signatures

Maze
Ransomware family also known as ChaCha.
trojan ransomware maze
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DenyStep.png => C:\Users\Admin\Pictures\DenyStep.png.a6mvN9Z	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File renamed	C:\Users\Admin\Pictures\MergeCopy.crw => C:\Users\Admin\Pictures\MergeCopy.crw.Pvzx	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File renamed	C:\Users\Admin\Pictures\ResolveStop.raw => C:\Users\Admin\Pictures\ResolveStop.raw.Pvzx	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File opened for modification	C:\Users\Admin\Pictures\WaitResolve.tiff	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File renamed	C:\Users\Admin\Pictures\WaitResolve.tiff => C:\Users\Admin\Pictures\WaitResolve.tiff.DJu9X	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Drops startup file 2 IoCs

Processes:

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9v8c8tjtm.dat	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp"	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

pid	Process
1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exevssvc.exewmic.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1212	wmic.exe
Token: SeSecurityPrivilege	1212	wmic.exe
Token: SeTakeOwnershipPrivilege	1212	wmic.exe
Token: SeLoadDriverPrivilege	1212	wmic.exe
Token: SeSystemProfilePrivilege	1212	wmic.exe
Token: SeSystemtimePrivilege	1212	wmic.exe
Token: SeProfSingleProcessPrivilege	1212	wmic.exe
Token: SeIncBasePriorityPrivilege	1212	wmic.exe
Token: SeCreatePagefilePrivilege	1212	wmic.exe
Token: SeBackupPrivilege	1212	wmic.exe
Token: SeRestorePrivilege	1212	wmic.exe
Token: SeShutdownPrivilege	1212	wmic.exe
Token: SeDebugPrivilege	1212	wmic.exe
Token: SeSystemEnvironmentPrivilege	1212	wmic.exe
Token: SeRemoteShutdownPrivilege	1212	wmic.exe
Token: SeUndockPrivilege	1212	wmic.exe
Token: SeManageVolumePrivilege	1212	wmic.exe
Token: 33	1212	wmic.exe
Token: 34	1212	wmic.exe
Token: 35	1212	wmic.exe
Token: SeIncreaseQuotaPrivilege	1212	wmic.exe
Token: SeSecurityPrivilege	1212	wmic.exe
Token: SeTakeOwnershipPrivilege	1212	wmic.exe
Token: SeLoadDriverPrivilege	1212	wmic.exe
Token: SeSystemProfilePrivilege	1212	wmic.exe
Token: SeSystemtimePrivilege	1212	wmic.exe
Token: SeProfSingleProcessPrivilege	1212	wmic.exe
Token: SeIncBasePriorityPrivilege	1212	wmic.exe
Token: SeCreatePagefilePrivilege	1212	wmic.exe
Token: SeBackupPrivilege	1212	wmic.exe
Token: SeRestorePrivilege	1212	wmic.exe
Token: SeShutdownPrivilege	1212	wmic.exe
Token: SeDebugPrivilege	1212	wmic.exe
Token: SeSystemEnvironmentPrivilege	1212	wmic.exe
Token: SeRemoteShutdownPrivilege	1212	wmic.exe
Token: SeUndockPrivilege	1212	wmic.exe
Token: SeManageVolumePrivilege	1212	wmic.exe
Token: 33	1212	wmic.exe
Token: 34	1212	wmic.exe
Token: 35	1212	wmic.exe
Token: SeBackupPrivilege	304	vssvc.exe
Token: SeRestorePrivilege	304	vssvc.exe
Token: SeAuditPrivilege	304	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1112	wmic.exe
Token: SeSecurityPrivilege	1112	wmic.exe
Token: SeTakeOwnershipPrivilege	1112	wmic.exe
Token: SeLoadDriverPrivilege	1112	wmic.exe
Token: SeSystemProfilePrivilege	1112	wmic.exe
Token: SeSystemtimePrivilege	1112	wmic.exe
Token: SeProfSingleProcessPrivilege	1112	wmic.exe
Token: SeIncBasePriorityPrivilege	1112	wmic.exe
Token: SeCreatePagefilePrivilege	1112	wmic.exe
Token: SeBackupPrivilege	1112	wmic.exe
Token: SeRestorePrivilege	1112	wmic.exe
Token: SeShutdownPrivilege	1112	wmic.exe
Token: SeDebugPrivilege	1112	wmic.exe
Token: SeSystemEnvironmentPrivilege	1112	wmic.exe
Token: SeRemoteShutdownPrivilege	1112	wmic.exe
Token: SeUndockPrivilege	1112	wmic.exe
Token: SeManageVolumePrivilege	1112	wmic.exe
Token: 33	1112	wmic.exe
Token: 34	1112	wmic.exe
Token: 35	1112	wmic.exe
Token: SeIncreaseQuotaPrivilege	1112	wmic.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

description	pid	Process	procid_target
PID 1372 wrote to memory of 1212	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	28
PID 1372 wrote to memory of 1212	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	28
PID 1372 wrote to memory of 1212	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	28
PID 1372 wrote to memory of 1212	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	28
PID 1372 wrote to memory of 1112	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	34
PID 1372 wrote to memory of 1112	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	34
PID 1372 wrote to memory of 1112	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	34
PID 1372 wrote to memory of 1112	1372	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	34

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
"C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\wbem\wmic.exe
  "C:\sst\yjxco\edhe\..\..\..\Windows\cw\..\system32\lk\..\wbem\hgbgl\moa\kcqq\..\..\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\system32\wbem\wmic.exe
  "C:\jsrlr\..\Windows\q\oapp\yftt\..\..\..\system32\fe\lx\..\..\wbem\f\nt\mpqf\..\..\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:304

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x184
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\DECRYPT-FILES.html

Filesize
6KB

MD5
725650c500cff77d3ec9a86c8bab1935

SHA1
51e452b91c91fa85747d7fd15c0948391a471e35

SHA256
dc36ede05a1f51c209c0f63f4e9a99f4681f010f4f10093004206ae7f2d5b864

SHA512
1b048bee3b0bef9208bfd55b1f18ce6e1468030a93c6edaf603b2f43f28bdf287dd332ad84f1453016223de918ca3364955886add5decbcde8290a53de5ca2a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_C6A79B7328454367BF75B81D8490ABD9.dat

Filesize
940B

MD5
12fd0cbb14c6d1e7ce2437d5fbb3de01

SHA1
d09a503b0908d207fd1026a7192df0a9f7fdca40

SHA256
170759707573dea5ccdd65e40ea3350c1cfd172548f6cef9bd74807a3f704e40

SHA512
a3263e360cbea602acaccf43f32a65afa9e1fe49eef4fecd44697bb8b2e5cb2829746a4e4d60c4b97f9b663b9b85b10ecabf10effa79d29b40c1db216fc4a2f0

Download Submit
memory/1372-54-0x0000000000270000-0x00000000002C9000-memory.dmp

Filesize
356KB

Download
memory/1372-55-0x0000000000520000-0x000000000057B000-memory.dmp

Filesize
364KB

Download
memory/1372-59-0x0000000000520000-0x000000000057B000-memory.dmp

Filesize
364KB

Download
memory/1372-62-0x0000000000520000-0x000000000057B000-memory.dmp

Filesize
364KB

Download
memory/1372-66-0x0000000000520000-0x000000000057B000-memory.dmp

Filesize
364KB

Download
memory/1372-1749-0x0000000000520000-0x000000000057B000-memory.dmp

Filesize
364KB

Download