Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
31-10-2023 03:31
Static task
static1
Behavioral task
behavioral1
Sample
f45a18ae5714d1aeb067f1b4f4923073.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
f45a18ae5714d1aeb067f1b4f4923073.dll
Resource
win10v2004-20231023-en
General
-
Target
f45a18ae5714d1aeb067f1b4f4923073.dll
-
Size
364KB
-
MD5
f45a18ae5714d1aeb067f1b4f4923073
-
SHA1
e6f53d26e2734bbcb91ec828883465db3d40666d
-
SHA256
e0f7bff1502dfca58121b84627d51ff2622857fd247123b4160833a5806b2bf2
-
SHA512
bad89a98965bb21239fd644c4a0d3de4a09e51e0e4f8b24d2e158621d07730e395e287d91317b374e4443bef0ad4c919140bf36fc165b5e59a4b72a674c812f9
-
SSDEEP
6144:5HTs5cIzrLrLrLgsVJIS+Nn49MS0BqQOrCV50DErFNg/ydlb4fQ6wFMv53:uYha0QdDENg6dNoQl+vB
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-1154728922-3261336865-3456416385-1000\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c210cb7a929f79d
https://mazedecrypt.top/6c210cb7a929f79d
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops file in Program Files directory 29 IoCs
description ioc Process File opened for modification C:\Program Files\RemoveRename.docx rundll32.exe File opened for modification C:\Program Files\RestoreReceive.pps rundll32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files\ResumeInitialize.mhtml rundll32.exe File opened for modification C:\Program Files\StepUnprotect.m1v rundll32.exe File opened for modification C:\Program Files\SwitchReset.wps rundll32.exe File opened for modification C:\Program Files\UndoLimit.m4a rundll32.exe File opened for modification C:\Program Files\MoveSubmit.xps rundll32.exe File opened for modification C:\Program Files\SubmitCompare.mp2v rundll32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt rundll32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6c210cb7a929f79d.tmp rundll32.exe File opened for modification C:\Program Files\ExportWrite.htm rundll32.exe File opened for modification C:\Program Files\JoinDisable.cfg rundll32.exe File opened for modification C:\Program Files\SaveSet.wpl rundll32.exe File opened for modification C:\Program Files (x86)\6c210cb7a929f79d.tmp rundll32.exe File opened for modification C:\Program Files\RenameUnprotect.m4v rundll32.exe File opened for modification C:\Program Files\SplitMerge.mpg rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6c210cb7a929f79d.tmp rundll32.exe File opened for modification C:\Program Files\UpdateJoin.mov rundll32.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6c210cb7a929f79d.tmp rundll32.exe File created C:\Program Files\DECRYPT-FILES.txt rundll32.exe File opened for modification C:\Program Files\InstallLimit.ttc rundll32.exe File opened for modification C:\Program Files\MergeRestore.xsl rundll32.exe File opened for modification C:\Program Files\PushInvoke.cab rundll32.exe File opened for modification C:\Program Files\6c210cb7a929f79d.tmp rundll32.exe File opened for modification C:\Program Files\MoveSkip.wav rundll32.exe File opened for modification C:\Program Files\UninstallLimit.mpeg rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1912 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1396 vssvc.exe Token: SeRestorePrivilege 1396 vssvc.exe Token: SeAuditPrivilege 1396 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1912 2644 rundll32.exe 28 PID 2644 wrote to memory of 1912 2644 rundll32.exe 28 PID 2644 wrote to memory of 1912 2644 rundll32.exe 28 PID 2644 wrote to memory of 1912 2644 rundll32.exe 28 PID 2644 wrote to memory of 1912 2644 rundll32.exe 28 PID 2644 wrote to memory of 1912 2644 rundll32.exe 28 PID 2644 wrote to memory of 1912 2644 rundll32.exe 28 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f45a18ae5714d1aeb067f1b4f4923073.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f45a18ae5714d1aeb067f1b4f4923073.dll,#12⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5a6bc87ffab145ec344f4bca0fd578ae6
SHA184287315dc22e9395176ba73672b81167ecf6564
SHA256e0bca39a8d65aa5d6fa66c73cdfb5f914f4b738bcd92e757f0e919d0ba3dfc91
SHA512a7e7c1f5927ae7c7e345ae2d876c875993b93c8a417dfc96aa1ce8e9865ba67a2c9198801de9f75fa630a5d9f8a02cfa99d3391ae7e489785139980b5cdd88cc