Overview

overview

10

Static

static

3

44f19c9175...c0.exe

windows10-2004-x64

10

44f19c9175...c0.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    44f19c91753f5ea8f3b24e4efb06f58544ca528a48cabfe2d1f84ce2b3296dc0
  • Size 2.9MB
  • Sample260826-1f2vlatzev
  • SHA256 44f19c91753f5ea8f3b24e4efb06f58544ca528a48cabfe2d1f84ce2b3296dc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
mazecredential_accessdiscoverypersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\DECRYPT-FILES.txt

Ransom Note
  • ======================================================== What happened? ======================================================== Greetings, Heerim Architects & Planners! Your IT infrastructure has been compromised. More than 5TB of data have been exfiltrated from your network. Your files have been encrypted and, in addition all your computers are now infected with file-infecting software that will re-initiate encryption every time new data is created on your machines. ======================================================== What can you do? ======================================================== Options are limited. One option is to attempt restoration on your own, but you will face significant obstacles during this process while the file infector remains active in the network. Additionally, you will have to deal with the publication of a blog post containing your data, analyzed by our AI. This will include a useful breakdown of sensitive data that can be utilized by other threat actors, both cyber and physical. ======================================================== How to contact us? ======================================================== To get in touch with us, you can use the links below. - https://secpzero-support.cfd/040da5/29ad0e0445afb6be6189640 - http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/040da5/29ad0e0445afb6be6189640 To access the onion link, you'll need to download and install the Tor Browser (https://www.torproject.org/download). ======================================================== How do we differ from average ransomware actors? ======================================================== You may be advised by recovery companies not to make contact with us. Usually, data publication is not considered highly dangerous for a company because it is impossible to download all data due to Tor network outages and slowdowns. However, that is not the case with us. We will provide a special breakdown of your company using our AI analysis tool on our data leakage website. This site is designed specifically to operate over TOR without slowdowns, featuring a useful file browser that provides contents in real-time without delay, eliminating the need to download useless data. You can view this using the links below in the OUR BLOG section, featuring different companies on which we have tested our AI. Furthermore, as we have stated, this is the first time in history that file-infecting software has been used for persistence. Usually, it is simple to roll back backups and resolve the issue; however, in this case, the persistence is very deep. We possess a special cryptographically signed file that can switch the infection off, along with a special cure utility that can clean all your infected files, stopping the persistent re-encryption of your data. ======================================================== Our blog ======================================================== - https://secp0-news.pw - http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion To access the onion link, you'll need to download and install the Tor Browser (https://www.torproject.org/download). ---BELOW IS TECHNICAL INFORMATION REQUIRED FOR US TO PROVIDE YOU WITH DECRYPTION TOOL, DO NOT REDACT--- data_begin 43Li4N4Z9w1YDeBUFbzvII7sLkwC7KB5rTWFYWM/DjoCZ/H8wesKCRQP2GVtmSdQ5Zmw5kJolmwewGSxi53yAfADUjkBdm+8q9TdUM1B5pvUK8/5JUUQwxqlWPSe4sNF9QYC1FUzLU3taMoVn/SNV3VCOrKtckhKnHwuu5ts+w04W7AEAAAAAQAAADIAOQBhAGQAMABlADAANAA0ADUAYQBmAGIANgBiAGUANgAxADgAOQA2ADQAMAAAAAAAAAAAAAAAAAAAAAAAAABXAE8AUgBLAEcAUgBPAFUAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== data_end ---FINISH---
URLs

  • https://secpzero-support.cfd/040da5/29ad0e0445afb6be6189640

  • http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/040da5/29ad0e0445afb6be6189640

  • https://secp0-news.pw

  • http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion

Extracted

Path

  • C:\$Recycle.Bin\DECRYPT-FILES.txt

Ransom Note
  • ======================================================== What happened? ======================================================== Greetings, Heerim Architects & Planners! Your IT infrastructure has been compromised. More than 5TB of data have been exfiltrated from your network. Your files have been encrypted and, in addition all your computers are now infected with file-infecting software that will re-initiate encryption every time new data is created on your machines. ======================================================== What can you do? ======================================================== Options are limited. One option is to attempt restoration on your own, but you will face significant obstacles during this process while the file infector remains active in the network. Additionally, you will have to deal with the publication of a blog post containing your data, analyzed by our AI. This will include a useful breakdown of sensitive data that can be utilized by other threat actors, both cyber and physical. ======================================================== How to contact us? ======================================================== To get in touch with us, you can use the links below. - https://secpzero-support.cfd/040da5/e354bf9b279efdee6189640 - http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/040da5/e354bf9b279efdee6189640 To access the onion link, you'll need to download and install the Tor Browser (https://www.torproject.org/download). ======================================================== How do we differ from average ransomware actors? ======================================================== You may be advised by recovery companies not to make contact with us. Usually, data publication is not considered highly dangerous for a company because it is impossible to download all data due to Tor network outages and slowdowns. However, that is not the case with us. We will provide a special breakdown of your company using our AI analysis tool on our data leakage website. This site is designed specifically to operate over TOR without slowdowns, featuring a useful file browser that provides contents in real-time without delay, eliminating the need to download useless data. You can view this using the links below in the OUR BLOG section, featuring different companies on which we have tested our AI. Furthermore, as we have stated, this is the first time in history that file-infecting software has been used for persistence. Usually, it is simple to roll back backups and resolve the issue; however, in this case, the persistence is very deep. We possess a special cryptographically signed file that can switch the infection off, along with a special cure utility that can clean all your infected files, stopping the persistent re-encryption of your data. ======================================================== Our blog ======================================================== - https://secp0-news.pw - http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion To access the onion link, you'll need to download and install the Tor Browser (https://www.torproject.org/download). ---BELOW IS TECHNICAL INFORMATION REQUIRED FOR US TO PROVIDE YOU WITH DECRYPTION TOOL, DO NOT REDACT--- data_begin FXkOtfm/OZYJMhu1RdWkZnN76oi1WOCnqx9TB91v3UUDVzkvkypL/cpuGzBXBaKqXEqrVTYCrH5rkcSooDFhv+kD7xD3EOV/spKKNrddfUiF9Hz5ZReFVJaSbHZ3g7A9zH0C1FUzLU3taMoVn/SNV3VCOrKtckhKnHwuu5ts+w04W7AEAAAAAQAAAGUAMwA1ADQAYgBmADkAYgAyADcAOQBlAGYAZABlAGUANgAxADgAOQA2ADQAMAAAAAAAAAAAAAAAAAAAAAAAAABXAE8AUgBLAEcAUgBPAFUAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== data_end ---FINISH---
URLs

  • https://secpzero-support.cfd/040da5/e354bf9b279efdee6189640

  • http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/040da5/e354bf9b279efdee6189640

  • https://secp0-news.pw

  • http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion

Targets

    • Target
      44f19c91753f5ea8f3b24e4efb06f58544ca528a48cabfe2d1f84ce2b3296dc0
    • Size 2.9MB
    • SHA256 44f19c91753f5ea8f3b24e4efb06f58544ca528a48cabfe2d1f84ce2b3296dc0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoverymazepersistenceprivilege_escalationransomwarespywarestealertrojan

    • Family: Maze

      Ransomware family also known as ChaCha.

      trojanransomwaremaze

    • Renames multiple (2797) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks