Analysis
-
max time kernel
205s -
max time network
241s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 03:21
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win10v2004-20230220-en
General
-
Target
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Malware Config
Extracted
C:\odt\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6bef0cac45fde2e1
https://mazedecrypt.top/6bef0cac45fde2e1
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6bef0cac45fde2e1.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6bef0cac45fde2e1.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification C:\Program Files\SuspendResize.mhtml VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\UnlockCompress.mhtml VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\FormatEnable.docx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\MeasureImport.jpe VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\InitializeFind.xml VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\PushJoin.html VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\DismountPing.mp4v VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\FindSend.xps VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ReceiveInstall.ocx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SuspendUnprotect.dwg VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\UseCheckpoint.ocx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\EnterStart.mpeg3 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ExitRename.xml VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\GrantNew.vdx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\GrantUnprotect.ini VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RemoveLock.tif VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\6bef0cac45fde2e1.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\6bef0cac45fde2e1.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1100 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe 1100 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 224 vssvc.exe Token: SeRestorePrivilege 224 vssvc.exe Token: SeAuditPrivilege 224 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD514edc0b95785d082cfa01fb706935dcb
SHA185d2b3aad7c0366a9397c41f050fbbcd1ed0c51e
SHA256080d710db3d39260681e726ffd5dee92890a0acf4d0f88f48579344eb1c471f5
SHA512343b263b8a16091afc1032d9f2ca0235ebce32b61a31841f7c56df3ed9f6a059f6c33e70187e93c908d2c7435571fb40662a5bcd40c0edccfed4d142326159b0