maze | 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167

Analysis

user interaction
yes
max time kernel
298s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/04/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAZE.exe
Size 898KB
Sample260413-xh6d1set9j
SHA256 4263eacd358d5ef9efacff1f63ff79487639136c0268938755a4bfe3f5797167
MD5 61b32a82577a7ea823ff7303ab6b4283
SHA1 9107c719795fa5768498abb4fed11d907e44d55e
SHA512 86ac9d3d0804f5dd3ebe08ab59058363bceeaa3f42d2d482f97ce688837b3b81693fde2b973250b93ee3223318b0f8e4f2faf6b0f91017807feacabce979d700
SSDEEP 12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo
TLSH
T17115E109EA93DBF9CE4F4871205F632E2F3749561F908DB3DAD025609CB1A4A7B63718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution maze impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\DECRYPT-FILES.txt

maze

Ransom Note

Attention! ---------------------------- | What happened? ---------------------------- We hacked your network and now all your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms. You cannot access the files right now. But do not worry. You can get it back! It is easy to recover in a few steps. We have also downloaded a lot of private data from your network, so in case of not contacting us as soon as possible this data will be released. If you do not contact us in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. To see what happens to those who don't contact us, google: * Southwire Maze Ransomware * MDLab Maze Ransomware * City of Pensacola Maze Ransomware After the payment the data will be removed from our disks and decryptor will be given to you, so you can restore all your files. ---------------------------- | How to contact us and get my files back? ---------------------------- The only method to restore your files and be safe from data leakage is to purchase a unique for you private key which is securely stored on our servers. To contact us and purchase the key you have to visit our website in a hidden TOR network. There are general 2 ways to reach us: 1) [Recommended] Using hidden TOR network. a) Download a special TOR browser: https://www.torproject.org/ b) Install the TOR Browser. c) Open the TOR Browser. d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/6bc70cb172c9e69d e) Follow the instructions on this page. 2) If you have any problems connecting or using TOR network a) Open our website: https://mazedecrypt.top/6bc70cb172c9e69d b) Follow the instructions on this page. Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use. On this page, you will see instructions on how to make a free decryption test and how to pay. Also it has a live chat with our operators and support team. ---------------------------- | What about guarantees? ---------------------------- We understand your stress and worry. So you have a FREE opportunity to test a service by instantly decrypting for free three files from every system in your network. If you have any problems our friendly support team is always here to assist you in a live chat! P.S. Dear system administrators, do not think you can handle it by yourself. Inform leadership as soon as possible. By hiding the fact of the breach you will be eventually fired and sometimes even sued. ------------------------------------------------------------------------------- THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU ---BEGIN MAZE KEY--- zEd4xXvB/GXCHCUOrK1L7xIAuGh0a6H5fAfyk3DDcPxdOhT1wo2C9+D8YFbRA/a316BWGwM/vxeh4DL7y1f1cc28hejuARRekfnnITqG9ZVyTvo6GAOY+tT96cabaAHS5AJdL4fIt3mopWKQRUswj2N9h67nziyb8YHL2/7+ey6QH1QYWZoW2CQ4qjEtDgzlehsOwZLaihOmSOrWLNM8iM+cQv3d/sxKz/rXxWkjUDrcbCnhH6w/Br4k8QACN+pxRfk3okCpA5cDFX8l2RV6Z6Knr7i7JB6zH3w8ww877iAu3jPTV1MeuQ72s1HMa7uL6fDycvVcHB45Q7cFN8rVZYndMtoUJC1mNMVtJovZG47ErQhyZXnhqC0YtS444SWxDNrPHdBGt4qXS/Yno8yH4TfKmKaWDJgaExV3lVxd8qFxUuyDTgbXMi4edKoBrJF3h4ZusGJVTWFDxq+HiYhAdNcsA3Xx7apibIEXr4XcFjBnO7n4iRoNxfwwlpEfawwBGUxl88cibAZdoe2nkMsMY9mPaUCdUaeYb+BOUM1PXEkoIe2xBF2bh935yOB4uwW5yaP2xxGsiq7SDfE84ulxSKT0D9dpTUspdortUB/mh9o+xEHm3xj2uDo/7hGu2IgQdP1aYdarjbSmCGhp3AeG6ArpGkRpyKb0SLnRbbO8AqqiL0dIVJ1t9h2Xpq60edhjq/jiXA3FnxDAw7Znk4I1J7BU92Cv8WVxP4sAqH6/Lov7BCGlyGFWF3SS47+BlZtO0l/ZBrnWHOW/fOoPKHrlTQWOmn80sYzioyMNZ6Ub7fc/BVMWijfwAkn9HOj4yvUFm5hjkd4G0j6j5gb91YlS6vQGD940/1iDz46y/Lg3zfDe8xri1uSiG8av64JAG9KeVw+KuwXJCFSdxGtyymEcPiG+IlY2UlBc6XwnTeqiqqwOv0dDd3kuuFOydePg8f2rsC2JKX0HMom/5YzbbwgnJZyskd5SL2Z2sT1HfrMCH4qS7NVlhqqKU24EGfM+vYOoVDfN9OMXKIPIYpMp+T2IA6illLJe27fG1VlsD5Ndt9mQpRrOibgv0Ex1uB67HU4/pkEjCGzFQ9FA0zV0y/CmBFC8atNNZNXWveaTpJgqvJPZ/xXiIVbfmq713CzLxIfvBBUl/F1iYc3uD4tQB3WrIQo/Dpu1hFgblAC4/X7mpgqTqFPNTy3PcnWeXhRsRyJMl2ycxGHAZzjQdUEslGlfEKW1nhtYdNm5cegRM/A9kydK2kciLzJ21hCQkY1f5sGKLtnssC3arN2H2YaC/o4o3yVlSNOZbwXfMcSOSJ1MbIlZB2NfiefxVg+bcbkpT7qZzTUCK1b2rTCZWcO42BnLzBNHjAIuf8XQLTo4FTOmnSBRYG7Je9V5ikx7XRGRXF42R4vKBHPIjr5K4dzqbojP82LryiNUDO4m/npt0D8/c9IONIJsRh9vvoSIJjJ9MzH6HPdHGWbRymES+VC/isrZp4eHZ09QDsmeYGEWjhdCUR6hB8GT3pQZpmNV8ZAOzAGAPuZMY9/imWiRC6mOKTwqMqrlt0MCN0oT9GNwnDOVoXt3rpo0rTg+H6scY4PII3ObFvY+Cqfv8ZoLC7XHn/vTmdT6K/pOAzxqHrANxuz4W53rJtImSULxT8IqsOKbkW1z8WAD/9EwyiWqGsIhJe2WY3G+4Ph+s/Ew1GR2x/4bpMxaRvLKT6ZGTh9tm00NaO/9CqDRI0FDfwCj59ZjXUgpNCTfASsJVaJYyNMdJwdfIqewmHals37EiOXYOBQpksAenuqo0J5y1cYOw8+g7EehwcZOo6uc6fSZjyCvktRnc0NGsBdVZnnCqh7N0rHnQcTQx+cDpBO1GL1rdZb5No6Y49pK3vaBLdgGnVGMPjppv/j2YCS4U6w432PKXBstByMlHFMw+T5imhp1suxzN0804X6Zto/6w7LhBpJlca4T7bazza9hnJA892QVN/A0hhyPy4DepMVsHPh0YUaJdueWi483L/3sJKdNDZmLsZPvB+69RJN5xi4UwEdRgbyVl65Pqs15Q+ruyZaG9Wkndp5ayVw0SQVo2T3fMAjoCUTAiT1a0TOcLReb7wVeZxb3peLNdZD0wl5VWlaM4oDQwgg7GtMKGZCDntuIBKv/V2QZQhTQAHPvkN5/TgxAsFmcscMK23MHqFSq6CdGq6VjmGIo75C6OseyJ4idlek6pfG1SMKjndGYhbcD5BZxbOPhspUAVzOwEwoiNgBiAGMANwAwAGMAYgAxADcAMgBjADkAZQA2ADkAZAAAABCAYBoMQQBkAG0AaQBuAAAAIiZXAE8AUgBLAEcAUgBPAFUAUABcAEUAWQBHAEkAUABDAFgASAAAACoMbgBvAG4AZQB8AAAAMixXAGkAbgBkAG8AdwBzACAAMQAwACAARQBuAHQAZQByAHAAcgBpAHMAZQAAADoofABkAGUAcAByAGUAYwBhAHQAZQBkACAAPgAgAHYAMgAuADMAfAAAAEJWfABDAF8ARgBfADIAMAA0ADcAOQAvADIAMgAwADgAOAAxAHwARABfAFUAXwAwAC8AMAB8AEYAXwBGAF8AMgAwADQAMgAxAC8AMgAwADQANwA5AHwAAABIAFBAWIkIYIkIaIkIcNnm33J4DIABAYoBBTIuMy4x ---END MAZE KEY---

URLs

http://aoacugmutagkwctu.onion/6bc70cb172c9e69d
https://mazedecrypt.top/6bc70cb172c9e69d

Signatures

Family: Maze
Ransomware family also known as ChaCha.
trojan ransomware maze
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6bc70cb172c9e69d.tmp	MAZE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	MAZE.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6bc70cb172c9e69d.tmp	MAZE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	MAZE.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp"	MAZE.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DisconnectWatch.ppsm	MAZE.exe
File opened for modification	C:\Program Files\msedge_installer.log	MAZE.exe
File opened for modification	C:\Program Files\RequestProtect.ppt	MAZE.exe
File opened for modification	C:\Program Files\StopResume.pcx	MAZE.exe
File created	C:\Program Files\DECRYPT-FILES.txt	MAZE.exe
File opened for modification	C:\Program Files\ApproveMeasure.mp4	MAZE.exe
File opened for modification	C:\Program Files\AssertSwitch.ini	MAZE.exe
File opened for modification	C:\Program Files\chrome_installer.log	MAZE.exe
File opened for modification	C:\Program Files\MergeBlock.aifc	MAZE.exe
File opened for modification	C:\Program Files\AssertAdd.nfo	MAZE.exe
File opened for modification	C:\Program Files\CloseProtect.001	MAZE.exe
File opened for modification	C:\Program Files\ConvertRequest.potx	MAZE.exe
File opened for modification	C:\Program Files\ExitConvertTo.xsl	MAZE.exe
File opened for modification	C:\Program Files\PopConnect.asx	MAZE.exe
File opened for modification	C:\Program Files\PopWait.jpeg	MAZE.exe
File opened for modification	C:\Program Files\PublishSkip.wmf	MAZE.exe
File created	C:\Program Files (x86)\DECRYPT-FILES.txt	MAZE.exe
File opened for modification	C:\Program Files\EditFormat.mpg	MAZE.exe
File opened for modification	C:\Program Files\6bc70cb172c9e69d.tmp	MAZE.exe
File opened for modification	C:\Program Files\ConvertFromRead.dot	MAZE.exe
File opened for modification	C:\Program Files\ExpandRename.mpeg2	MAZE.exe
File opened for modification	C:\Program Files\OutPush.jpeg	MAZE.exe
File opened for modification	C:\Program Files\PopSet.mht	MAZE.exe
File opened for modification	C:\Program Files\AssertSet.7z	MAZE.exe
File opened for modification	C:\Program Files\CompleteCompare.wmf	MAZE.exe
File opened for modification	C:\Program Files\CompleteSearch.mhtml	MAZE.exe
File opened for modification	C:\Program Files\ConfirmOut.M2TS	MAZE.exe
File opened for modification	C:\Program Files\StepTest.wps	MAZE.exe
File opened for modification	C:\Program Files\FindUninstall.kix	MAZE.exe
File opened for modification	C:\Program Files\InitializeDisconnect.wax	MAZE.exe
File opened for modification	C:\Program Files\MoveGet.mht	MAZE.exe
File opened for modification	C:\Program Files\ResetResume.mpg	MAZE.exe
File opened for modification	C:\Program Files\SendSave.tiff	MAZE.exe
File opened for modification	C:\Program Files (x86)\6bc70cb172c9e69d.tmp	MAZE.exe
File opened for modification	C:\Program Files\ConvertFromMeasure.reg	MAZE.exe
File opened for modification	C:\Program Files\GrantEnter.dotx	MAZE.exe
File opened for modification	C:\Program Files\ReceiveSync.emf	MAZE.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAZE.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5280	MAZE.exe
5280	MAZE.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeBackupPrivilege	5172	vssvc.exe
Token: SeRestorePrivilege	5172	vssvc.exe
Token: SeAuditPrivilege	5172	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4928	wmic.exe
Token: SeSecurityPrivilege	4928	wmic.exe
Token: SeTakeOwnershipPrivilege	4928	wmic.exe
Token: SeLoadDriverPrivilege	4928	wmic.exe
Token: SeSystemProfilePrivilege	4928	wmic.exe
Token: SeSystemtimePrivilege	4928	wmic.exe
Token: SeProfSingleProcessPrivilege	4928	wmic.exe
Token: SeIncBasePriorityPrivilege	4928	wmic.exe
Token: SeCreatePagefilePrivilege	4928	wmic.exe
Token: SeBackupPrivilege	4928	wmic.exe
Token: SeRestorePrivilege	4928	wmic.exe
Token: SeShutdownPrivilege	4928	wmic.exe
Token: SeDebugPrivilege	4928	wmic.exe
Token: SeSystemEnvironmentPrivilege	4928	wmic.exe
Token: SeRemoteShutdownPrivilege	4928	wmic.exe
Token: SeUndockPrivilege	4928	wmic.exe
Token: SeManageVolumePrivilege	4928	wmic.exe
Token: 33	4928	wmic.exe
Token: 34	4928	wmic.exe
Token: 35	4928	wmic.exe
Token: 36	4928	wmic.exe
Token: SeIncreaseQuotaPrivilege	4928	wmic.exe
Token: SeSecurityPrivilege	4928	wmic.exe
Token: SeTakeOwnershipPrivilege	4928	wmic.exe
Token: SeLoadDriverPrivilege	4928	wmic.exe
Token: SeSystemProfilePrivilege	4928	wmic.exe
Token: SeSystemtimePrivilege	4928	wmic.exe
Token: SeProfSingleProcessPrivilege	4928	wmic.exe
Token: SeIncBasePriorityPrivilege	4928	wmic.exe
Token: SeCreatePagefilePrivilege	4928	wmic.exe
Token: SeBackupPrivilege	4928	wmic.exe
Token: SeRestorePrivilege	4928	wmic.exe
Token: SeShutdownPrivilege	4928	wmic.exe
Token: SeDebugPrivilege	4928	wmic.exe
Token: SeSystemEnvironmentPrivilege	4928	wmic.exe
Token: SeRemoteShutdownPrivilege	4928	wmic.exe
Token: SeUndockPrivilege	4928	wmic.exe
Token: SeManageVolumePrivilege	4928	wmic.exe
Token: 33	4928	wmic.exe
Token: 34	4928	wmic.exe
Token: 35	4928	wmic.exe
Token: 36	4928	wmic.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 4928	5280	MAZE.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MAZE.exe
"C:\Users\Admin\AppData\Local\Temp\MAZE.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\system32\wbem\wmic.exe
  "C:\yfqwl\..\Windows\nwfsr\..\system32\gfh\rakwq\..\..\wbem\doymj\jju\qf\..\..\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x388 0x328
1⤵
PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SP_B70BE7162B3D412EB70522FF15A142AE.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_B70BE7162B3D412EB70522FF15A142AE.dat
Size 940B
SHA256 9a42a6506acf197165712d18b58991c1fc613a3d2df449734631cbbca1707a5a
MD5 f98d27b876db75e3f49f52b539826deb
SHA1 d7b6fd17f52ea91d10754a18454ef9c25f253568
SHA512 4241d0a444e823fd221a7fbbff7f60400edf8967d75427cf4d40901efae5cb8bafd411b220ab0b4c7b2833e116d47715a800fc316d20bcce6b64eb8edf4e6f10
TLSH
T181112BE041183D06C08BF438072429A045C11080B10C60C2763429906DA1DE41102EC2
MD5 SHA1 SHA512 TLSH

Submit Download

DECRYPT-FILES.txt

Path F:\$RECYCLE.BIN\S-1-5-21-1609746302-1884177235-1125644204-1000\DECRYPT-FILES.txt
Size 10KB
SHA256 847a01494cc01b259a20625bac3dd17e4a5ad604b9fb5615a6a5bcfa79e81d8d
MD5 15bbe4c77f5c98dc5c95e2f240cdab32
SHA1 bc064c64207ba83c75485b461b5bd60ac5a88aec
SHA512 fdae7e5747cff19f3dc3f2a3085bd26b46d8300625f8d8ca42f26cb56c338cb99a2aef5163897f70b6d798dbef267efc1ade84591661b37cad8e53b55285764f
SSDEEP 192:6RMdDVCd5IcFak6sfUQQWUW5ZuQU42E2EFBF50/dWkT7A9C:6a8Ok6sDQwZC42E2kjSdWGt
TLSH
T10B3245217AFA4019B2B37F545BF421B5CA7ABDA26C39DD9C0190014E0ABEE40DDA0F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4928-1456-0x0000020BF5140000-0x0000020BF5170000-memory.dmp

Download

memory/5280-5-0x0000000000630000-0x000000000068E000-memory.dmp

Download

memory/5280-0-0x0000000000630000-0x000000000068E000-memory.dmp

Download

memory/5280-9-0x0000000000630000-0x000000000068E000-memory.dmp

Download

memory/5280-13-0x0000000000630000-0x000000000068E000-memory.dmp

Download

memory/5280-1452-0x0000000002060000-0x00000000020F6000-memory.dmp

Download

memory/5280-1453-0x0000000002D70000-0x0000000002D77000-memory.dmp

Download

memory/5280-1468-0x0000000000630000-0x000000000068E000-memory.dmp

Download