Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 09:47
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240426-en
General
-
Target
1.exe
-
Size
447KB
-
MD5
9823800f063a1d4ee7a749961db7540f
-
SHA1
9d2917a668b30ba9f6b3e7a3316553791eb1c052
-
SHA256
a9524de985a3ecc43e11dd7c051a4bbfe08c3d71cde98ea9bb6ea7f32c0cb174
-
SHA512
c48624e32dba7f08ce0ca8267e541b123c6a9bf848b81d9e62f7fc4bec9b8ed801a6204ffaece4decf0d31bf2595867ff6f8c0b176e366848b61145cc585e41e
-
SSDEEP
12288:Yn+KS3UINuBGCz0SxWUNmH2o8PXwU9Eq7zKloxTwRtjauqCXy3X:Y+FUKWAHNqXwUlzD9w7PqCin
Malware Config
Extracted
C:\Users\DECRYPT-FILES.html
<b>[email protected]</b>
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 4 IoCs
Processes:
1.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html 1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\03m9b7.dat 1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html 1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\03m9b7.dat 1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" 1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1.exepid process 3404 1.exe 3404 1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exevssvc.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 4976 wmic.exe Token: SeSecurityPrivilege 4976 wmic.exe Token: SeTakeOwnershipPrivilege 4976 wmic.exe Token: SeLoadDriverPrivilege 4976 wmic.exe Token: SeSystemProfilePrivilege 4976 wmic.exe Token: SeSystemtimePrivilege 4976 wmic.exe Token: SeProfSingleProcessPrivilege 4976 wmic.exe Token: SeIncBasePriorityPrivilege 4976 wmic.exe Token: SeCreatePagefilePrivilege 4976 wmic.exe Token: SeBackupPrivilege 4976 wmic.exe Token: SeRestorePrivilege 4976 wmic.exe Token: SeShutdownPrivilege 4976 wmic.exe Token: SeDebugPrivilege 4976 wmic.exe Token: SeSystemEnvironmentPrivilege 4976 wmic.exe Token: SeRemoteShutdownPrivilege 4976 wmic.exe Token: SeUndockPrivilege 4976 wmic.exe Token: SeManageVolumePrivilege 4976 wmic.exe Token: 33 4976 wmic.exe Token: 34 4976 wmic.exe Token: 35 4976 wmic.exe Token: 36 4976 wmic.exe Token: SeIncreaseQuotaPrivilege 4976 wmic.exe Token: SeSecurityPrivilege 4976 wmic.exe Token: SeTakeOwnershipPrivilege 4976 wmic.exe Token: SeLoadDriverPrivilege 4976 wmic.exe Token: SeSystemProfilePrivilege 4976 wmic.exe Token: SeSystemtimePrivilege 4976 wmic.exe Token: SeProfSingleProcessPrivilege 4976 wmic.exe Token: SeIncBasePriorityPrivilege 4976 wmic.exe Token: SeCreatePagefilePrivilege 4976 wmic.exe Token: SeBackupPrivilege 4976 wmic.exe Token: SeRestorePrivilege 4976 wmic.exe Token: SeShutdownPrivilege 4976 wmic.exe Token: SeDebugPrivilege 4976 wmic.exe Token: SeSystemEnvironmentPrivilege 4976 wmic.exe Token: SeRemoteShutdownPrivilege 4976 wmic.exe Token: SeUndockPrivilege 4976 wmic.exe Token: SeManageVolumePrivilege 4976 wmic.exe Token: 33 4976 wmic.exe Token: 34 4976 wmic.exe Token: 35 4976 wmic.exe Token: 36 4976 wmic.exe Token: SeBackupPrivilege 4640 vssvc.exe Token: SeRestorePrivilege 4640 vssvc.exe Token: SeAuditPrivilege 4640 vssvc.exe Token: SeIncreaseQuotaPrivilege 3924 wmic.exe Token: SeSecurityPrivilege 3924 wmic.exe Token: SeTakeOwnershipPrivilege 3924 wmic.exe Token: SeLoadDriverPrivilege 3924 wmic.exe Token: SeSystemProfilePrivilege 3924 wmic.exe Token: SeSystemtimePrivilege 3924 wmic.exe Token: SeProfSingleProcessPrivilege 3924 wmic.exe Token: SeIncBasePriorityPrivilege 3924 wmic.exe Token: SeCreatePagefilePrivilege 3924 wmic.exe Token: SeBackupPrivilege 3924 wmic.exe Token: SeRestorePrivilege 3924 wmic.exe Token: SeShutdownPrivilege 3924 wmic.exe Token: SeDebugPrivilege 3924 wmic.exe Token: SeSystemEnvironmentPrivilege 3924 wmic.exe Token: SeRemoteShutdownPrivilege 3924 wmic.exe Token: SeUndockPrivilege 3924 wmic.exe Token: SeManageVolumePrivilege 3924 wmic.exe Token: 33 3924 wmic.exe Token: 34 3924 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1.exedescription pid process target process PID 3404 wrote to memory of 4976 3404 1.exe wmic.exe PID 3404 wrote to memory of 4976 3404 1.exe wmic.exe PID 3404 wrote to memory of 3924 3404 1.exe wmic.exe PID 3404 wrote to memory of 3924 3404 1.exe wmic.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\system32\wbem\wmic.exe"C:\fo\..\Windows\kjmpu\..\system32\henc\k\..\..\wbem\c\q\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
-
C:\Windows\system32\wbem\wmic.exe"C:\lwh\l\h\..\..\..\Windows\law\bmev\..\..\system32\ctw\..\wbem\jy\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x340 0x33c1⤵PID:4820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_6E2CF7E8D7C6456AAF4CDEBB49446A31.dat
Filesize940B
MD5e6896275c24ce6ee96428b260b2e1f49
SHA13fdb0f99e453e843040d035a0335d53b96dff482
SHA2569810631d516652d194e02b73caa693a2f96f2cb2f0832690dc3b7c898e8e608f
SHA5121a6525c1991faa44f06f3269409dbc2a9de40ad76c77c96d8c3027bd54f064dc302934f27b876579057555192a6315f7d8236fc3a80f7a9078f02a670f44bfbc
-
Filesize
6KB
MD5f3a004037a99a158411eb8aa6a6e4e0c
SHA1cac1390b911f96283d1e8478f3b246fc54699811
SHA25611bf3cb866b3fd442353a0c240c7cfb8ab82a0a90574729606e7d35db8e96753
SHA5128ab651df876074754b577babbc6323f7bddbc2d172617975bd57b7768328ba61e397f609bc96dc551f1dc63f1e80e592fa8cba3d93fd34f9a4d3c5a93864633c