| File name: | Maze.exe |
| Full analysis: | https://app.any.run/tasks/bf0d6230-7f20-4e59-bfce-be83a4fa4d85 |
| Verdict: | Malicious activity |
| Threats: | Maze is ransomware — a malware type that encrypts the victim’s files and restores the data in exchange for a ransom payment. One of the most distinguishable features of Maze is that it is one of the first malware of the kind to publicly release stolen data. |
| Analysis date: | April 16, 2024, 08:04:32 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 61B32A82577A7EA823FF7303AB6B4283 |
| SHA1: | 9107C719795FA5768498ABB4FED11D907E44D55E |
| SHA256: | 4263EACD358D5EF9EFACFF1F63FF79487639136C0268938755A4BFE3F5797167 |
| SSDEEP: | 12288:20lnPLRBrenjExzDKNg6dNoQl+vtMyOo/mSVTWa5QLeuXwuxbvRr/LpiRPMBp:201PLX0GferoQOMyySVa/VFbvhtiRPo |
MALICIOUS
Deletes shadow copies
- Maze.exe (PID: 1020)
Writes a file to the Word startup folder
- Maze.exe (PID: 1020)
Create files in the Startup directory
- Maze.exe (PID: 1020)
Drops the executable file immediately after the start
- Maze.exe (PID: 1020)
Renames files like ransomware
- Maze.exe (PID: 1020)
Actions looks like stealing of personal data
- Maze.exe (PID: 1020)
Maze ransom note is found
- Maze.exe (PID: 1020)
SUSPICIOUS
Reads the Internet Settings
- WMIC.exe (PID: 2984)
- Maze.exe (PID: 1020)
- WMIC.exe (PID: 3600)
Creates file in the systems drive root
- Maze.exe (PID: 1020)
Reads security settings of Internet Explorer
- Maze.exe (PID: 1020)
Connects to the server without a host name
- Maze.exe (PID: 1020)
Creates files like ransomware instruction
- Maze.exe (PID: 1020)
INFO
Checks supported languages
- Maze.exe (PID: 1020)
- wmpnscfg.exe (PID: 2644)
Reads the computer name
- Maze.exe (PID: 1020)
- wmpnscfg.exe (PID: 2644)
Reads product name
- Maze.exe (PID: 1020)
Creates files in the program directory
- Maze.exe (PID: 1020)
Creates files or folders in the user directory
- Maze.exe (PID: 1020)
Reads the machine GUID from the registry
- Maze.exe (PID: 1020)
Reads Environment values
- Maze.exe (PID: 1020)
Checks proxy server information
- Maze.exe (PID: 1020)
Create files in a temporary directory
- Maze.exe (PID: 1020)
Manual execution by a user
- explorer.exe (PID: 4004)
- rundll32.exe (PID: 1928)
- wmpnscfg.exe (PID: 2644)
- notepad.exe (PID: 3024)
- taskmgr.exe (PID: 2540)
Dropped object may contain TOR URL's
- Maze.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | DOS Executable Generic (100) |
|---|
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2006:11:10 03:13:44+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 913408 |
| InitializedDataSize: | - |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1000 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Total processes
59
Monitored processes
11
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1020 | "C:\Users\admin\AppData\Local\Temp\Maze.exe" | C:\Users\admin\AppData\Local\Temp\Maze.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 1928 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\aidbin.rtf.zfvpNlO | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2168 | C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2480 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2540 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\System32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2644 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2984 | "C:\f\..\Windows\bah\nk\ggm\..\..\..\system32\ems\o\..\..\wbem\searw\tsgcd\kpegv\..\..\..\wmic.exe" shadowcopy delete | C:\Windows\System32\wbem\WMIC.exe | — | Maze.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 2147749908 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3024 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\DECRYPT-FILES.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3492 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3600 | "C:\e\urng\uwq\..\..\..\Windows\qyy\ew\..\..\system32\nld\nrdv\avfg\..\..\..\wbem\cnkb\tgwpp\libg\..\..\..\wmic.exe" shadowcopy delete | C:\Windows\System32\wbem\WMIC.exe | — | Maze.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 2147749908 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 739
Read events
3 591
Write events
133
Delete events
15
Modification events
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyServer |
Value: | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyOverride |
Value: | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoConfigURL |
Value: | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoDetect |
Value: | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (1020) Maze.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
0
Suspicious files
393
Text files
403
Unknown types
474
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1020 | Maze.exe | C:\ProgramData\data1.tmp | binary | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\Users\admin\AppData\Local\VirtualStore\DECRYPT-FILES.txt | text | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\DECRYPT-FILES.txt | text | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\MSOCache\DECRYPT-FILES.txt | text | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\DECRYPT-FILES.txt | text | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\Users\admin\DECRYPT-FILES.txt | text | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\Users\admin\.oracle_jre_usage\DECRYPT-FILES.txt | text | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | vc | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.C9Gk | — | |
MD5:— | SHA256:— | |||
| 1020 | Maze.exe | C:\Users\admin\AppData\DECRYPT-FILES.txt | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
60
DNS requests
1
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1020 | Maze.exe | POST | — | 91.218.114.11:80 | http://91.218.114.11/account/hvnbxcq.shtml?ey=sdrp&awv=66&gwll=0&wmc=m411ts8153 | RU | — | — | unknown |
1020 | Maze.exe | POST | — | 91.218.114.11:80 | http://91.218.114.11/wvcmn.php?tl=shb2&tab=05j836e2&vldh=2&nh=p3t8laugr5 | RU | — | — | unknown |
1020 | Maze.exe | POST | 404 | 91.218.114.11:80 | http://91.218.114.11/wvcmn.php?tl=shb2&tab=05j836e2&vldh=2&nh=p3t8laugr5 | RU | html | 207 b | unknown |
1020 | Maze.exe | POST | 404 | 91.218.114.11:80 | http://91.218.114.11/account/hvnbxcq.shtml?ey=sdrp&awv=66&gwll=0&wmc=m411ts8153 | RU | html | 219 b | unknown |
1020 | Maze.exe | POST | 404 | 91.218.114.37:80 | http://91.218.114.37/signin/signin/glbragsp.asp?rlr=04j&y=3jo73g&tutn=1046&b=x4 | RU | html | 153 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1020 | Maze.exe | 91.218.114.4:80 | — | Hostkey B.v. | RU | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1020 | Maze.exe | 91.218.114.11:80 | — | Hostkey B.v. | RU | unknown |
1020 | Maze.exe | 91.218.114.25:80 | — | Hostkey B.v. | RU | unknown |
1020 | Maze.exe | 91.218.114.26:80 | — | Hostkey B.v. | RU | unknown |
1020 | Maze.exe | 91.218.114.31:80 | — | Hostkey B.v. | RU | unknown |
1020 | Maze.exe | 91.218.114.32:80 | — | Hostkey B.v. | RU | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dns.msftncsi.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1020 | Maze.exe | A Network Trojan was detected | ET MALWARE Maze/ID Ransomware Activity |
— | — | A Network Trojan was detected | ET MALWARE Maze/ID Ransomware Activity |
— | — | A Network Trojan was detected | ET MALWARE Maze/ID Ransomware Activity |
— | — | A Network Trojan was detected | ET MALWARE Maze/ID Ransomware Activity |
1020 | Maze.exe | A Network Trojan was detected | ET MALWARE Maze/ID Ransomware Activity |