{"id":89183,"date":"2020-06-18T14:47:55","date_gmt":"2020-06-18T09:17:55","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=89183"},"modified":"2020-06-18T17:17:27","modified_gmt":"2020-06-18T11:47:27","slug":"maze-ransomware-continues-threat-consumers","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/maze-ransomware-continues-threat-consumers\/","title":{"rendered":"Maze ransomware continues to be a threat to the consumers"},"content":{"rendered":"

Maze is a recently highlighted ransomware among the ever-growing list of ransomware families. The ransomware is active from the past one year, although it came into limelight due to its new approach of publishing sensitive data of infected customers publicly.<\/p>\n

The malware uses different techniques to gain entry like the use of exploit kits or email impersonation. These phishing emails are having a Word document attachment that contains macros to run the malware in the system.<\/p>\n

Maze uses CHA-CHA algorithm for encryption and its key is encrypted using the RSA algorithm. Maze can run with or without mutex \u2014it uses some Russian IPs for the webserver to sends information from the victim system(s). It uses RSA encryption request for CnC communication and it will not encrypt the system for the specific region by checking keyboard type.<\/p>\n

Stage \u2013 I<\/strong><\/p>\n

VBA MACRO<\/strong><\/p>\n

The attached document file has a form containing an input box in which the number array of encrypted URL and path is present. The document file contains an ActiveX object. When it is executed, URL and path are decrypted post which it calls URLDownloadToFileA() that downloads an executable to the specified location.<\/p>\n

\"\"<\/p>\n

Fig 1. URLDownloadToFileA() Call with their parameters<\/em><\/h6>\n

 <\/p>\n

The number array is read from text box then converted into characters and concatenated to form a URL and path where the file is downloaded. Sometimes it also uses PowerShell to download the file. In most of the cases, file is downloaded at \u201cC:\\Windows\\temp\u201d location.<\/p>\n

\"\"<\/p>\n

Fig 2. Characters stored in Number Array<\/em><\/h6>\n

 <\/p>\n

Stage \u2013 II<\/strong><\/p>\n

A. CRYPTER<\/strong><\/p>\n

The first stage of Maze ransomware is custom cryptor. This cryptor is a packed one with few imports. It loads libraries by calling LoadLibrary() and GetProcAddress() from kernel32.dll. In this cryptor, function names are stored with their adler32 checksum.<\/p>\n

The cryptor is for anti-debugging, it passes junk strings to the function OutputDebugStringW().<\/p>\n

\"\"<\/p>\n

Fig 3. Call to OutputDebugStringW()<\/em><\/h6>\n

In the below code, it checks whether the file is present or not, if present it will terminate. Similarly, it also checks specific command-line arguments if it is present it will change execution flow. Then malware loads the resource where actual DLL is present. The loaded resource is encrypted and XOR operation is used with key 0x41. After decryption, we get base64 encoded data.<\/p>\n

\"\"<\/p>\n

Fig 4. Xor Loop and API resolution<\/em><\/h6>\n

After copying all data onto the stack, API names are formed and then it calls Loadlibrary() Win32 API. Then it decodes base64 data by calling CryptStringToBinaryA() API. The decrypted buffer is again decrypted using CHA-CHA 20 algorithm which brings the actual payload of Maze ransomware. Along with payload (which is a DLL of Maze), it also decrypts shellcode. By using CreateThread() API, it executes the shellcode.<\/p>\n

\"\"<\/p>\n

Fig 5. Call to CreateThread()<\/em><\/h6>\n

In this payload code, it first loads the base address of kernel32 for PEB. The below code shows the loading of the address.<\/p>\n

\"\"<\/p>\n

Fig 6. The address is loaded from PEB<\/em><\/h6>\n

The shellcode allocates memory using VirtualAlloc() and copies DLL file to newly allocated space. Then it creates a thread and executes code from DLL. This code changes bytes at the original entry point and then jump to OEP.<\/p>\n

B. MAZE PAYLOAD<\/strong><\/p>\n

In decrypted payload, it first loads all the APIs and then does patching of dbgUiRemoteBreakin from ntdl.dll. It is one of the anti-debugging techniques it uses to avoid attachment of debugger.<\/p>\n

First it calls VirtualProtect() on dbgUiRemoteBreakin<\/strong> with PAGE_EXECUTE_READWRITE as new flNewProtect. Then it replaces byte 6A with C3 by simple mov instruction. So, if someone tries to attach debugger it will get failed.<\/p>\n

\"\"<\/p>\n

Fig 7. Copy 0xC3 at dbgUiRemoteBreakin Entry point<\/em><\/h6>\n

 <\/p>\n

\"\"<\/p>\n

Fig 8. Code before and after patching<\/em><\/h6>\n

Then it enumerates running processes using Process32First() and process32Next(). It calls APIs using \u2018je\u2019 instruction and address is pushed onto the stack which is executed after API call. The call is replaced with \u2018push\u2019 and \u2018jz\u2019 or \u2018je\u2019 instruction.<\/p>\n

\"\"<\/p>\n

Fig 9. Call to Process32NextW () using jz instruction<\/em><\/h6>\n

After process enumeration, it will obfuscate all the names with its algorithm which uses XMM registers. Then it calculates the hash of this obfuscated string which is then compared with some hardcoded hashes. Some of them are:<\/p>\n

Procmon64.exe: 0x776E0635<\/p>\n

Procexp64.exe: 0x78020640<\/p>\n

Ida.exe: 0x33840485<\/p>\n

Dumpcap.exe: 0x5FB805C5<\/p>\n

X32dbg.exe: 0x5062053<\/p>\n

\"\"<\/p>\n

Fig 10: Compare hashes with running process hashes<\/em><\/h6>\n

When any of the process hash matches it calls TerminateProcess() and exits the running process.<\/p>\n

It will not encrypt files for specific keyboard type. To get keyboard type it calls the function GetUserDefaultUILanguage(). For eg:<\/p>\n

Russsian : 0x419 \/\/ NOT Encrypt For this value<\/p>\n

Ukrainian : 0x422 \/\/ NOT Encrypt For this value<\/p>\n

Serbian : 0x7C1A \/\/ NOT Encrypt For this value<\/p>\n

en_US : 0x409 \/\/ Encrypt For this value<\/p>\n

\"\"<\/p>\n

Fig 11. Check value return by GetUserDefaultUILanguage()<\/em><\/h6>\n

Then It first communicates with CnC server where the IP list is hardcoded, all below mentioned IP seems to belong to Russia.<\/p>\n

91.218.114.4<\/p>\n

91.218.114.11<\/p>\n

91.218.114.25<\/p>\n

91.218.114.26<\/p>\n

91.218.114.32<\/p>\n

91.218.114.37<\/p>\n

91.218.114.38<\/p>\n

\"\"<\/p>\n

Fig 12. Hardcoded Ip list<\/em><\/h6>\n

Then data is sent to CnC on the first request: Data which is sent is Username, Computername, OsVersion.<\/p>\n

Malware create mutex with unique ID unique ID is created using SHA(GetComputerName() + VolumeID()) .<\/p>\n

For the ransomware marker, it creates a unique file on root and each folder.<\/p>\n

Maze Encryption Process:<\/strong><\/p>\n

Malware selects files for encryption based on the extension. It excludes the following extensions:<\/p>\n

\u00b7 Exe<\/p>\n

\u00b7 Dll<\/p>\n

\u00b7 Sys<\/p>\n

\u00b7 lnk<\/p>\n

It also excludes the following files:<\/p>\n

\u00b7 Decrypt-Files.txt<\/p>\n

\u00b7 Autorun.inf<\/p>\n

\u00b7 Boot.ini<\/p>\n

\u00b7 Desktop.ini<\/p>\n

\u00b7 Temp\/000.bmp<\/p>\n

Excluded folders:<\/p>\n

%windows%, @gaming%, %programdata%, %tor Brower%, %local Settings%, %appdata% etc<\/p>\n

\"\"<\/p>\n

Fig 13. Checking folder names and if the same found it will not encrypt the folder.<\/em><\/h6>\n

Encryption process:<\/strong><\/p>\n

It first creates key and then exports it in the \u201cc:\\programdata\\data1.tmp\u201d folder. Then it drops a ransom note in each folder before encryption. Later it will just import the key from this file and call \u201cCryptEncrypt()\u201d.<\/p>\n

It retrieves drive letters and then determine type of drive using GetDriveType(). Further it enumerates using API calls FindFirstFileA() and FindNextFileA().<\/p>\n

It deletes shadow copy by creating a fake path for wmic and then calls delete recover by calling CreateProcessW()It encrypts files using CHA-CHA algorithm and the key of chacha is encrypted using RSA. For this, it uses crypto APIs. Encrypted files are having a marker at the end which is \u201866116166\u2019.<\/p>\n

\"\"<\/p>\n

Fig 14. Encrypted File by Maze ransomware<\/em><\/h6>\n

It creates a thread for each drive, which then again call create thread function for each folder which does the encryption. Encryption will start from the root of C: or D: and parallelly it also accesses the shared drive by using WNetShareEnum() API. The same encryption function is used for encrypting shared drive files. The first folder which is encrypted is \u201c$Recycle Bin\u201d.<\/p>\n

CreateThread() with following function for each folder. File is opened as follows. File is encrypted by calling CryptEncrypt() and it is renamed by calling moveFileEx() with extension.<\/p>\n

Encrypted File:<\/strong><\/p>\n

\"\"<\/p>\n

Fig 15. File After encryption<\/em><\/h6>\n

Maze Malware uses many tactics for anti-Analysis:<\/strong><\/p>\n

    \n
  • APIs are resolved at runtime.<\/li>\n
  • Indirect calling of API & functions using JE & JNE instructions.<\/li>\n
  • Patching DbgUiRemoteTracking to avoid attaching of debugger at runtime.<\/li>\n
  • Checking being debugged flag.<\/li>\n
  • Checking for VM.<\/li>\n
  • Checks RAM & hardware size by using API \u2013 GlobalMemoryStatusEx & GetDiskeSpaceW.<\/li>\n
  • Check process names by calculating its hashes.<\/li>\n<\/ul>\n

    Prevention measures to stay away from ransomware<\/strong><\/p>\n

    Common infection vectors used by Maze Ransomware are phishing emails with MS Office attachments and fake\/phishing websites laced with Exploit Kits. Hence, we advise our end users to exercise caution while handling emails from unknown sources, downloading MS Office attachments, enabling macros, and clicking on suspicious links.<\/p>\n

    Indicators of compromise<\/strong><\/p>\n

    49B28F16BA496B57518005C813640EEB<\/p>\n

    BD9838D84FD77205011E8B0C2BD711E0<\/p>\n

    Subject Matter Expert<\/strong>
    \nPreksha Saxena | Quick Heal Security Labs<\/div>\n","protected":false},"excerpt":{"rendered":"

    Maze is a recently highlighted ransomware among the ever-growing list of ransomware families. The ransomware is active from the past one year, although it came into limelight due to its new approach of publishing sensitive data of infected customers publicly. The malware uses different techniques to gain entry like the use of exploit kits or […]<\/p>\n","protected":false},"author":45,"featured_media":89199,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-89183","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/89183"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/45"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=89183"}],"version-history":[{"count":6,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/89183\/revisions"}],"predecessor-version":[{"id":89205,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/89183\/revisions\/89205"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/89199"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=89183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=89183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=89183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}