maui | c482d2d04f8f62a2151a859fffa41c24af65a397f6fad5203914954465f635b3

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 00:42

Target
2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe
Size 763KB
Sample240615-a2t4rsshja
SHA256 c482d2d04f8f62a2151a859fffa41c24af65a397f6fad5203914954465f635b3
MD5 967201031711e5d7d77cc1d04c23cf4b
SHA1 409fe9bd5e0850164786d76887e442a732c7b0e5
SHA512 475e67f31d2390d5534a9ec0d0503379d1c134ed9178ccba4536fd0fc6248d39275514b79ec6b7b0b83cae494299fdebd3c5ddba27904604e80d9608a905042b
SSDEEP 12288:p+2NRE6xDWPOO3Kt7RJatTrAtfpYqCX9b:phRxWPOO3Kt7FfpYhXx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

maui ransomware

Detect Maui ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/3024-0-0x0000000000190000-0x0000000000256000-memory.dmp	family_maui

Maui Ransomware
Ransomware-as-a-Service which first appeared in 2022.
ransomware maui

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4000	3024	WerFault.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_967201031711e5d7d77cc1d04c23cf4b_maui_revil.exe"
1⤵
PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 304
  2⤵
  - Program crash
  PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3024 -ip 3024
1⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4092,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:2524

memory/3024-0-0x0000000000190000-0x0000000000256000-memory.dmp

Download