Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 09:47
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240426-en
General
-
Target
1.exe
-
Size
447KB
-
MD5
9823800f063a1d4ee7a749961db7540f
-
SHA1
9d2917a668b30ba9f6b3e7a3316553791eb1c052
-
SHA256
a9524de985a3ecc43e11dd7c051a4bbfe08c3d71cde98ea9bb6ea7f32c0cb174
-
SHA512
c48624e32dba7f08ce0ca8267e541b123c6a9bf848b81d9e62f7fc4bec9b8ed801a6204ffaece4decf0d31bf2595867ff6f8c0b176e366848b61145cc585e41e
-
SSDEEP
12288:Yn+KS3UINuBGCz0SxWUNmH2o8PXwU9Eq7zKloxTwRtjauqCXy3X:Y+FUKWAHNqXwUlzD9w7PqCin
Malware Config
Extracted
C:\$Recycle.Bin\DECRYPT-FILES.html
<b>[email protected]</b>
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
Processes:
1.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kv030iq.dat 1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html 1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
1.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" 1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1.exepid Process 2092 1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exevssvc.exewmic.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2888 wmic.exe Token: SeSecurityPrivilege 2888 wmic.exe Token: SeTakeOwnershipPrivilege 2888 wmic.exe Token: SeLoadDriverPrivilege 2888 wmic.exe Token: SeSystemProfilePrivilege 2888 wmic.exe Token: SeSystemtimePrivilege 2888 wmic.exe Token: SeProfSingleProcessPrivilege 2888 wmic.exe Token: SeIncBasePriorityPrivilege 2888 wmic.exe Token: SeCreatePagefilePrivilege 2888 wmic.exe Token: SeBackupPrivilege 2888 wmic.exe Token: SeRestorePrivilege 2888 wmic.exe Token: SeShutdownPrivilege 2888 wmic.exe Token: SeDebugPrivilege 2888 wmic.exe Token: SeSystemEnvironmentPrivilege 2888 wmic.exe Token: SeRemoteShutdownPrivilege 2888 wmic.exe Token: SeUndockPrivilege 2888 wmic.exe Token: SeManageVolumePrivilege 2888 wmic.exe Token: 33 2888 wmic.exe Token: 34 2888 wmic.exe Token: 35 2888 wmic.exe Token: SeIncreaseQuotaPrivilege 2888 wmic.exe Token: SeSecurityPrivilege 2888 wmic.exe Token: SeTakeOwnershipPrivilege 2888 wmic.exe Token: SeLoadDriverPrivilege 2888 wmic.exe Token: SeSystemProfilePrivilege 2888 wmic.exe Token: SeSystemtimePrivilege 2888 wmic.exe Token: SeProfSingleProcessPrivilege 2888 wmic.exe Token: SeIncBasePriorityPrivilege 2888 wmic.exe Token: SeCreatePagefilePrivilege 2888 wmic.exe Token: SeBackupPrivilege 2888 wmic.exe Token: SeRestorePrivilege 2888 wmic.exe Token: SeShutdownPrivilege 2888 wmic.exe Token: SeDebugPrivilege 2888 wmic.exe Token: SeSystemEnvironmentPrivilege 2888 wmic.exe Token: SeRemoteShutdownPrivilege 2888 wmic.exe Token: SeUndockPrivilege 2888 wmic.exe Token: SeManageVolumePrivilege 2888 wmic.exe Token: 33 2888 wmic.exe Token: 34 2888 wmic.exe Token: 35 2888 wmic.exe Token: SeBackupPrivilege 2476 vssvc.exe Token: SeRestorePrivilege 2476 vssvc.exe Token: SeAuditPrivilege 2476 vssvc.exe Token: SeIncreaseQuotaPrivilege 2716 wmic.exe Token: SeSecurityPrivilege 2716 wmic.exe Token: SeTakeOwnershipPrivilege 2716 wmic.exe Token: SeLoadDriverPrivilege 2716 wmic.exe Token: SeSystemProfilePrivilege 2716 wmic.exe Token: SeSystemtimePrivilege 2716 wmic.exe Token: SeProfSingleProcessPrivilege 2716 wmic.exe Token: SeIncBasePriorityPrivilege 2716 wmic.exe Token: SeCreatePagefilePrivilege 2716 wmic.exe Token: SeBackupPrivilege 2716 wmic.exe Token: SeRestorePrivilege 2716 wmic.exe Token: SeShutdownPrivilege 2716 wmic.exe Token: SeDebugPrivilege 2716 wmic.exe Token: SeSystemEnvironmentPrivilege 2716 wmic.exe Token: SeRemoteShutdownPrivilege 2716 wmic.exe Token: SeUndockPrivilege 2716 wmic.exe Token: SeManageVolumePrivilege 2716 wmic.exe Token: 33 2716 wmic.exe Token: 34 2716 wmic.exe Token: 35 2716 wmic.exe Token: SeIncreaseQuotaPrivilege 2716 wmic.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1.exedescription pid Process procid_target PID 2092 wrote to memory of 2888 2092 1.exe 28 PID 2092 wrote to memory of 2888 2092 1.exe 28 PID 2092 wrote to memory of 2888 2092 1.exe 28 PID 2092 wrote to memory of 2888 2092 1.exe 28 PID 2092 wrote to memory of 2716 2092 1.exe 34 PID 2092 wrote to memory of 2716 2092 1.exe 34 PID 2092 wrote to memory of 2716 2092 1.exe 34 PID 2092 wrote to memory of 2716 2092 1.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\wbem\wmic.exe"C:\k\..\Windows\xhfx\gklf\nysx\..\..\..\system32\vtvuu\..\wbem\riqje\uusq\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\system32\wbem\wmic.exe"C:\w\m\j\..\..\..\Windows\fis\t\..\..\system32\f\..\wbem\uwpu\xwmj\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD54f2f870ebe1a7b1a11a0980f43a707d2
SHA1aa649f1562e0276796dbd7d0d18be57b640c1404
SHA25640e9ac8e55c4a54a5cd239dba933ab229eb5bbccd2031abd2b912bed147ad0e6
SHA51248a4c5fc9efcda5b3b3e886fc1b616dbf367d0cd998b100429da9e310f28aa32ff915c62b6020821030536a756d84b2f8cdb8b2b7a4e105bc92647212e16555e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_3478803ECE304549A93692129C440131.dat
Filesize940B
MD5871ce001718c255cdef77ded5201e209
SHA11935107b1b0cb246cd9dec41447e4a6e4c7465df
SHA256811ed77405b73b73b745745c2f8679a16394a131468697ef0b27ccc3cd563e21
SHA512dbc35a9e5b875e32a5d6277104d1e62f17ce6cadaf33c0b2dea59aa3fedcfb2808b8ef380c418e08b56c250fe25fd13deb9063621aef73dd9f2b274c5aeaf22d