Analysis
-
max time kernel
169s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 03:21
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win10v2004-20230220-en
General
-
Target
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Malware Config
Extracted
C:\MSOCache\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6cd10cc6b4481b5c
https://mazedecrypt.top/6cd10cc6b4481b5c
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6cd10cc6b4481b5c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 42 IoCs
description ioc Process File opened for modification C:\Program Files\MountExpand.vstx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RevokeConvertFrom.dib VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SetExpand.odt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SkipPop.wpl VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\DenyRevoke.7z VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\JoinImport.wav VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\CopySearch.mov VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\DenyFind.jtx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\HideSwitch.mp3 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\NewResume.wm VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RestartOpen.vsdm VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RevokeInvoke.dib VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\CompletePush.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ConvertFromRestart.wpl VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SaveSend.xlt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6cd10cc6b4481b5c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SubmitTest.php VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\AssertBlock.M2T VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ConvertFromMove.001 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RemoveClear.vsd VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RepairReset.gif VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\UsePublish.search-ms VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6cd10cc6b4481b5c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RegisterExpand.001 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SaveRepair.au3 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SendWatch.odt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\StepSelect.cfg VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6cd10cc6b4481b5c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\6cd10cc6b4481b5c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ExportSkip.cab VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ReceiveHide.svg VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\6cd10cc6b4481b5c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\UninstallRename.rm VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\FormatSearch.pptx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ResolveInitialize.vssm VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\DisconnectPop.mpeg3 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\MountUninstall.ex_ VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 948 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1412 vssvc.exe Token: SeRestorePrivilege 1412 vssvc.exe Token: SeAuditPrivilege 1412 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:948
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD55a67fbefd837bb039acb6e1a2484fd21
SHA1955229b54cbf5366d034f02e83ae5eb7d2cd038a
SHA2562d717ca4536886bdfaa29e7d8ef8ea97eae23f4365f9b57535c8365f40ec9eae
SHA51228326547a8321cca0298680e367ff50280d1f643d84f5580cca27a29fcefa2a8360f6f635a424e1e72b028708fd49451d23672577d597d79b05493e4cbb493f7