maze | 4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
Size

777KB
MD5

f5ecda7dd8bb1c514f93c09cea8ae00d
SHA1

f5e03c44b584367241cbd2152fbd99fcc9ccd43f
SHA256

4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d
SHA512

6ba2928825cced798d61cd1880525cbed4aeb79b04b4ec050e9657dfe06a95c7df3dc663dfc0f71c306af05a1dce1c764a27c4e0662719a7ba1f370af3aeb7d9
SSDEEP

12288:v4wMnyVrf59Kyh+exQk0wc5xQZkosR8uMS19dLz6f:v4dWmyh+jk1cHQZauxS19dLz6f

Score

10^/10

maze credential_access defense_evasion discovery execution impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\DECRYPT-FILES.txt

Family

maze

Ransom Note

Attention! ---------------------------- | What happened? ---------------------------- All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms. You cannot access the files right now. But do not worry. You have a chance! It is easy to recover in a few steps. ---------------------------- | How to get my files back? ---------------------------- The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers. To contact us and purchase the key you have to visit our website in a hidden TOR network. There are general 2 ways to reach us: 1) [Recommended] Using hidden TOR network. a) Download a special TOR browser: https://www.torproject.org/ b) Install the TOR Browser. c) Open the TOR Browser. d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/888a0996ac713d6a e) Follow the instructions on this page. 2) If you have any problems connecting or using TOR network a) Open our website: https://mazedecrypt.top/888a0996ac713d6a b) Follow the instructions on this page. Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use. On this page, you will see instructions on how to make a free decryption test and how to pay. Also it has a live chat with our operators and support team. ---------------------------- | What about guarantees? ---------------------------- We understand your stress and worry. So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer! If you have any problems our friendly support team is always here to assist you in a live chat! ------------------------------------------------------------------------------- THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU ---BEGIN MAZE KEY--- Ky966q1FJCt2b/0SmL0cr8OXcSAkrAt8AJonXdy0nqlEVwgljRTyvwoUcBcLO3IDjT9NqSPD6lVTWvSyjvb4oODcyj5exARTzNJQ0euwDFd/PW4JOg2ounuxMqjZnbUU71+GEhjQP5faVLZiEk5Bq/V/QuPC6UKWOgIvoQfTZ6ldxhy9iWlmgYR0skEEJ5QkVNIsti2oq7VssGIuq5oLiuzG4pVejZta7dyIVxZggKWsum8YsvOm6Ctvf0yZCzgYoj6DHq+JnEL/96GzDYsI92Z6zg7XnwHgX2TOWyLErymdUUFT8mPChF+SD3ztX8Z6xJ39amO6NOTWHEAHyG/BFq/tjQFW8/c/wCQEmcT5SrAEXJ4//CR+7yGn1P8nRDrjkZK89eha1FevAh0CIt0qlotYuwmLs4SKOTiQbAQOBMuQDm06fzDVDEWytVTuoFnjH3AG0FRA+OR4TctlEpAiDsK/NXRNGyeQ2FmlZfMCWJZ6z2XE8iIlcCWX3xQNtDr+9RFQNGbgQZl7o0V5AuPKUTMc9iBs3fkbM+OZDms7zWMmFQZt91pGk7ZHuGO5S3ekG3+J6Jz3YNKIvalykGQW55/rbdeKN/cWxSEP338GHuBFMCk+OADlWFIT7CxEArkQWjuzAiFU7ULEZ0KrNcZC+JrSJbMt5sGtVx5z45PYlWj5AY6tOZP11ec0CAhQmnO1CD5GRVk4U/kEqfKH+ndLraxYK/EMYkhGEoh9PvPw7H0xpuY0AIMu8iSlfKt/1VEN4X/jOFW7K167bISPdbpnPcfnPJAUH6WMDyfFo6K7n+k4B5efoBY/3oH6UaRLx1VMaq3HX7MtEzd4212sjczTVlIwtFdCG5+yVGemSa0GwUwlGZVVYerE01nrRPizODLnsgSRcfaJW6hiWBbEIXu880pJk+CfQWs82wHaxKkDZoLX2VcxIGwf19euP2XaM+hyxSQDLI64WOTV5LTaNV06SWmCBB31ESt6ywqLzyGIn+B4JymPON/NLZSiVFjgPPcAZuMaT+leqs2ebjLvyKoDgLUj89e5maLytk2s/ZT7sG1lPRQ7QRXRTAJ9ZRcva2yLxAurIEAMekjYov0C/Zie0ctSFQcT3P6uYLTEi5czZtkvwjmkk8pMhoMb4ZtvYg3jRkFr9oLow+KGpWokGQ9LfkLN2ut8kLGb7T5oaRnDCu4g6Chd7J9n1yn4tZSuAnL6pm+/N2JpN9PPZH/nkw5pxnvJsacWqjuCGbF3imGuwLIwG8Xhr5v4Nh1A7R3qa1iHpsg/JxcVId4Ses3Z2QOOXKhumAB0h2Jmwn01mn/Gic10/SRL/Db/Mc98a5fWlWUBUzk9q1Zax/xpaOyx18nfHb3CGzibi8kOBdqE5sj8L3d44AtiPq+Wzu+DIJVlHZ+MXTNGuWtMB3qmQ8zcQCO68BRJPf4N37fJ3LJMweXtg1ytUiewqQ1VHEkSVUgr4wcSAZJJtK5phZ7o8yw4KCpZUUsYUy9I9ltcAQ2LASjoNc+pXflWJfZtIHeEsxgbjszKIAewJ6f4BreCKagFwFseYDcxptnqwoX2FC4YE6hxd80YNs/xdenu1Jvm181NTyWh6TkfReHk+nxnab+x49g3LN2XHtlS3GkSbjO1t5w/U7cSnSefAnhseBi/dTAYst/ruXzHRJ3GXQVDH2OEQlfwUKHfSLgf7kCft7v362DiWxivxNvzii/23Y++dD2tUqiwVAT/He1hmQIYdARiyALw6u58/0jsOi7YrvV8x2qTMWdKvKDzmecH1jRZJrqUZzYi7QgVU3qqU6MGfWBV7wvdW8Qo+fgnhS0LY+iYcI4HuLA4gDs0ElG4/O4Vkt6sUHxUaDVMeL7hIQrVX6BvRq6pckEC5j/dUH96qbJpJvG35qqhsDxb44XJXC4QK1c0wR41GHJCqe9yGickKcUncAcbJ9ClsZ+SMFt/SMT23N8l28eMFASfYtZFDuK9ybisiYIH3Saw0whLVteJ+hrpFOKhAzNZbMnuQ4SJNM4TjeZFGfUnef8AisO5bwLPPZ+EnHzeBtwEr525YU1bUegUwfLvj68MgXKa2+nqjJFdGMB/qYG49nWEfvzaLMdvjnZ8YKb63IpMG3xR5Guw+Uz2+AbBqL2P4A/S3BsOVLTPcZNG0us1u4/Ejno3/+xzJ9pdLXFloE6aD95WeWFpG87R6Q22p9lEo6HhEBdA0zBFTNZfAxEg9eLPetBjBpPa3r85BUhwEB73KwoiOAA4ADgAYQAwADkAOQA2AGEAYwA3ADEAMwBkADYAYQAAABCAYBoMQQBkAG0AaQBuAAAAIhJOAE4AWQBKAFoAQQBIAFAAAAAqDG4AbwBuAGUAfAAAADImVwBpAG4AZABvAHcAcwAgADcAIABVAGwAdABpAG0AYQB0AGUAAABCVnwAQwBfAEYAXwAyADAANAA4ADYALwAyADQAMQAzADYAMQB8AEQAXwBVAF8AMAAvADAAfABGAF8ARgBfADIAMAAzADgAOQAvADIAMAA0ADcAOQB8AAAASABQQFiJCGCJCGiJCHDUntp7eBCAAQGKAQUyLjEuMQ== ---END MAZE KEY---

URLs

http://aoacugmutagkwctu.onion/888a0996ac713d6a

https://mazedecrypt.top/888a0996ac713d6a

Signatures

Maze
Ransomware family also known as ChaCha.
trojan ransomware maze
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 4 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\888a0996ac713d6a.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\888a0996ac713d6a.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp"	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

Drops file in Program Files directory 21 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\888a0996ac713d6a.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ConfirmRead.bmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\JoinWatch.ocx	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ReadUpdate.i64	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\RestartProtect.csv	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Program Files (x86)\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\888a0996ac713d6a.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\RepairPing.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\SetRegister.asp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\888a0996ac713d6a.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Program Files\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\SelectClear.tif	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\SkipGroup.js	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\UnblockDisable.temp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\888a0996ac713d6a.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\SkipLimit.png	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\UnblockConnect.potm	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\888a0996ac713d6a.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exeDllHost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

pid	Process
2596	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

vssvc.exewmic.exe

description	pid	Process
Token: SeBackupPrivilege	2608	vssvc.exe
Token: SeRestorePrivilege	2608	vssvc.exe
Token: SeAuditPrivilege	2608	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2492	wmic.exe
Token: SeSecurityPrivilege	2492	wmic.exe
Token: SeTakeOwnershipPrivilege	2492	wmic.exe
Token: SeLoadDriverPrivilege	2492	wmic.exe
Token: SeSystemProfilePrivilege	2492	wmic.exe
Token: SeSystemtimePrivilege	2492	wmic.exe
Token: SeProfSingleProcessPrivilege	2492	wmic.exe
Token: SeIncBasePriorityPrivilege	2492	wmic.exe
Token: SeCreatePagefilePrivilege	2492	wmic.exe
Token: SeBackupPrivilege	2492	wmic.exe
Token: SeRestorePrivilege	2492	wmic.exe
Token: SeShutdownPrivilege	2492	wmic.exe
Token: SeDebugPrivilege	2492	wmic.exe
Token: SeSystemEnvironmentPrivilege	2492	wmic.exe
Token: SeRemoteShutdownPrivilege	2492	wmic.exe
Token: SeUndockPrivilege	2492	wmic.exe
Token: SeManageVolumePrivilege	2492	wmic.exe
Token: 33	2492	wmic.exe
Token: 34	2492	wmic.exe
Token: 35	2492	wmic.exe
Token: SeIncreaseQuotaPrivilege	2492	wmic.exe
Token: SeSecurityPrivilege	2492	wmic.exe
Token: SeTakeOwnershipPrivilege	2492	wmic.exe
Token: SeLoadDriverPrivilege	2492	wmic.exe
Token: SeSystemProfilePrivilege	2492	wmic.exe
Token: SeSystemtimePrivilege	2492	wmic.exe
Token: SeProfSingleProcessPrivilege	2492	wmic.exe
Token: SeIncBasePriorityPrivilege	2492	wmic.exe
Token: SeCreatePagefilePrivilege	2492	wmic.exe
Token: SeBackupPrivilege	2492	wmic.exe
Token: SeRestorePrivilege	2492	wmic.exe
Token: SeShutdownPrivilege	2492	wmic.exe
Token: SeDebugPrivilege	2492	wmic.exe
Token: SeSystemEnvironmentPrivilege	2492	wmic.exe
Token: SeRemoteShutdownPrivilege	2492	wmic.exe
Token: SeUndockPrivilege	2492	wmic.exe
Token: SeManageVolumePrivilege	2492	wmic.exe
Token: 33	2492	wmic.exe
Token: 34	2492	wmic.exe
Token: 35	2492	wmic.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2596 wrote to memory of 2492	2596	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe	33
PID 2596 wrote to memory of 2492	2596	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe	33
PID 2596 wrote to memory of 2492	2596	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe	33
PID 2596 wrote to memory of 2492	2596	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe	33

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\wbem\wmic.exe
  "C:\opoa\iniwh\jfp\..\..\..\Windows\i\..\system32\i\..\wbem\rsiwr\pdjmw\mon\..\..\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\DECRYPT-FILES.txt

Filesize
9KB

MD5
007a935ff083a30099a8fc7a8a39013c

SHA1
be83f11ab03415923e49135dd80f1a5f6ce39a4d

SHA256
b61c16224f3eb623978159b74fee984b15bd452e3c6d21d3911d975d61bd15ee

SHA512
c5ff794456323f176a1c2ad97c425d04ae4ece2a85f0711f686dde6055ffb90d8c95ef71610b30bc05e24df3ce99b50b764f8a7496bbcedc13b7df9bdab83da0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_A5FF707DC20147F78DA5656D698D3490.dat

Filesize
940B

MD5
4040613526226138692de4fe6efd63ce

SHA1
c677fb3c2efb2d2ee9b85f21efbc01a3bb56adb3

SHA256
4c54e8f50c07dd9580a4684f108ee2727b5765c8a2c97d82433b34ff9f35d911

SHA512
520bdfd01aabb901c3f7454c5f95542cbc79ebfc5574e0f585d826fb9d860152628925ee207215adb48e060e41acc785fd596d4dd517812109fbe4bb7c105552

Download Submit
memory/2596-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2596-1-0x0000000000250000-0x00000000002D7000-memory.dmp

Filesize
540KB

Download
memory/2596-2-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2596-773-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/2596-777-0x0000000000250000-0x00000000002D7000-memory.dmp

Filesize
540KB

Download
memory/2596-779-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2596-780-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download