Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-05-2023 17:48
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
Resource
win10v2004-20230220-en
General
-
Target
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe
-
Size
898KB
-
MD5
61b32a82577a7ea823ff7303ab6b4283
-
SHA1
9107c719795fa5768498abb4fed11d907e44d55e
-
SHA256
4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
-
SHA512
86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
-
SSDEEP
12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
Malware Config
Extracted
C:\MSOCache\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6cd10cc68975313c
https://mazedecrypt.top/6cd10cc68975313c
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exedescription ioc Process File renamed C:\Users\Admin\Pictures\ExitSync.crw => C:\Users\Admin\Pictures\ExitSync.crw.nibamR VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File renamed C:\Users\Admin\Pictures\SelectReceive.tif => C:\Users\Admin\Pictures\SelectReceive.tif.8Z8Q VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File renamed C:\Users\Admin\Pictures\SuspendTest.tif => C:\Users\Admin\Pictures\SuspendTest.tif.aLaH VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File renamed C:\Users\Admin\Pictures\UseStop.raw => C:\Users\Admin\Pictures\UseStop.raw.dw8Bod VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File renamed C:\Users\Admin\Pictures\DebugSelect.raw => C:\Users\Admin\Pictures\DebugSelect.raw.sGJ6y VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Users\Admin\Pictures\EnablePush.tiff VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File renamed C:\Users\Admin\Pictures\EnablePush.tiff => C:\Users\Admin\Pictures\EnablePush.tiff.nibamR VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Drops startup file 2 IoCs
Processes:
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6cd10cc68975313c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Drops file in Program Files directory 37 IoCs
Processes:
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exedescription ioc Process File opened for modification C:\Program Files\6cd10cc68975313c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\LockRename.emf VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\MountRestore.jpeg VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\AssertSplit.DVR-MS VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\CompressAdd.aiff VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\6cd10cc68975313c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ComparePop.wax VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ConfirmPublish.png VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ConvertToLock.ppt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\EnableGet.pptm VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\InvokeComplete.mpeg3 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\PushSuspend.docx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ShowSet.vst VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\UseProtect.3gp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6cd10cc68975313c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6cd10cc68975313c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\CheckpointCompress.raw VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\GetRename.ogg VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\GroupCompare.asx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\InstallRequest.mpp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\SkipExpand.kix VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\CompareResume.vsd VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\PopRestart.aif VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\PushRepair.vsdx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6cd10cc68975313c.tmp VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\AssertStop.mp2v VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\BackupEnable.au3 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\JoinUndo.mpeg VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ConvertFromCopy.clr VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\ConvertStop.easmx VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\RegisterSplit.WTV VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe File opened for modification C:\Program Files\UseFormat.scf VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exepid Process 1548 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
vssvc.exewmic.exeAUDIODG.EXEdescription pid Process Token: SeBackupPrivilege 676 vssvc.exe Token: SeRestorePrivilege 676 vssvc.exe Token: SeAuditPrivilege 676 vssvc.exe Token: SeIncreaseQuotaPrivilege 1144 wmic.exe Token: SeSecurityPrivilege 1144 wmic.exe Token: SeTakeOwnershipPrivilege 1144 wmic.exe Token: SeLoadDriverPrivilege 1144 wmic.exe Token: SeSystemProfilePrivilege 1144 wmic.exe Token: SeSystemtimePrivilege 1144 wmic.exe Token: SeProfSingleProcessPrivilege 1144 wmic.exe Token: SeIncBasePriorityPrivilege 1144 wmic.exe Token: SeCreatePagefilePrivilege 1144 wmic.exe Token: SeBackupPrivilege 1144 wmic.exe Token: SeRestorePrivilege 1144 wmic.exe Token: SeShutdownPrivilege 1144 wmic.exe Token: SeDebugPrivilege 1144 wmic.exe Token: SeSystemEnvironmentPrivilege 1144 wmic.exe Token: SeRemoteShutdownPrivilege 1144 wmic.exe Token: SeUndockPrivilege 1144 wmic.exe Token: SeManageVolumePrivilege 1144 wmic.exe Token: 33 1144 wmic.exe Token: 34 1144 wmic.exe Token: 35 1144 wmic.exe Token: SeIncreaseQuotaPrivilege 1144 wmic.exe Token: SeSecurityPrivilege 1144 wmic.exe Token: SeTakeOwnershipPrivilege 1144 wmic.exe Token: SeLoadDriverPrivilege 1144 wmic.exe Token: SeSystemProfilePrivilege 1144 wmic.exe Token: SeSystemtimePrivilege 1144 wmic.exe Token: SeProfSingleProcessPrivilege 1144 wmic.exe Token: SeIncBasePriorityPrivilege 1144 wmic.exe Token: SeCreatePagefilePrivilege 1144 wmic.exe Token: SeBackupPrivilege 1144 wmic.exe Token: SeRestorePrivilege 1144 wmic.exe Token: SeShutdownPrivilege 1144 wmic.exe Token: SeDebugPrivilege 1144 wmic.exe Token: SeSystemEnvironmentPrivilege 1144 wmic.exe Token: SeRemoteShutdownPrivilege 1144 wmic.exe Token: SeUndockPrivilege 1144 wmic.exe Token: SeManageVolumePrivilege 1144 wmic.exe Token: 33 1144 wmic.exe Token: 34 1144 wmic.exe Token: 35 1144 wmic.exe Token: 33 1564 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1564 AUDIODG.EXE Token: 33 1564 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1564 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
VirusShare_61b32a82577a7ea823ff7303ab6b4283.exedescription pid Process procid_target PID 1548 wrote to memory of 1144 1548 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe 31 PID 1548 wrote to memory of 1144 1548 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe 31 PID 1548 wrote to memory of 1144 1548 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe 31 PID 1548 wrote to memory of 1144 1548 VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe 31 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_61b32a82577a7ea823ff7303ab6b4283.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\system32\wbem\wmic.exe"C:\bu\ml\nqjpi\..\..\..\Windows\mt\tywo\cae\..\..\..\system32\eb\..\wbem\ne\rnosw\ivp\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:676
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:924
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1401⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5e3d0634ca08b287f7b2bce0a5975ae2a
SHA130ba19bf745a94b9b8cca7230952fe70b119647c
SHA256c29c5f711c69635e3b24cadb7b5c1c91030a7e1b52bc34439ef3b0384dc3c183
SHA512f71654c8a5b3281c6c65e9414e07feea9c8570024800905985b70ea69b0bbf02ae723326a16bd594fc7844e32661b356ea185e7ba045072da86f5ceef02e4bd3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_6734ED3E8A8E4F5A865F2B8FEF8F248E.dat
Filesize940B
MD5bc715473114e925df8ea5ea72f21b9ae
SHA1354a61a6f8dcbb9bb034d6e84fb7d379c54c89c9
SHA25628f42b9e582696e267cf1d6ab5ec5a17ca57109f569783af73a724e25c09622a
SHA512af5fda4c81903273f4faee117324e4716df0e877d0188e2f67b9a40defb6567db46bfd7f7eecdd881340148c9e748bc9923c3e56f2e3c1d14d2016edcaf97e11