Maze Ransomware

As of October 2020, Maze appears to be non-functional, with the group operating it seemingly moving to the Egregor ransom tool.

Threat ID:: CC-3078
Category:: Ransomware
Threat Severity:: Low
Threat Vector:: Email spam, Insecure network
Published:: 4 June 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

As of October 2020, Maze appears to be non-functional, with the group operating it seemingly moving to the Egregor ransom tool.

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Microsoft Windows

Threat details

Introduction

Maze, also known as ChaCha, is a newly observed ransomware tool that will alter its demanded ransom depending on the type of device it has infected.

Delivery

At the time of publication, Maze has only been observed being delivered by the Fallout exploit kit via compromised cryptocurrency sites.

Activities

Once installed, Maze will encrypt all non-system files using individual ChaCha20 keys, themselves encrypted using a master RSA key, before appending randomised extensions to each file. It will then attempt to determine the type of device it is installed on before displaying a separate ransom notes based on the device's perceived value.

Threat updates

Date	Update
30 Oct 2020	Maze shutting down The group behind Maze has announced to several cybersecurity researchers that they are ceasing operations. Whilst it is unclear why they are doing this, there is evidence suggesting they have shifted their efforts to the newer Egregor ransomware .
24 Sep 2020	VM encryption routine The latest version of Maze now uses an embedded VirtualBox instance with a custom Windows 7 virtual machine to encrypt targeted files. This is likely done to avoid detection from certain security services. It appears this behaviour has been taken from Ragnar Locker, another ransomware tool with known links to Maze's operators.

Date

Update

30 Oct 2020

Maze shutting down

The group behind Maze has announced to several cybersecurity researchers that they are ceasing operations.

Whilst it is unclear why they are doing this, there is evidence suggesting they have shifted their efforts to the newer Egregor ransomware .

24 Sep 2020

VM encryption routine

The latest version of Maze now uses an embedded VirtualBox instance with a custom Windows 7 virtual machine to encrypt targeted files. This is likely done to avoid detection from certain security services.

It appears this behaviour has been taken from Ragnar Locker, another ransomware tool with known links to Maze's operators.

Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

Critical data is frequently saved in multiple backup locations.
At least one backup is kept offline at any time (separated from live systems).
Backups and incident recovery plans are tested to ensure that data can be restored when needed.
User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
Infected systems are disconnected from the network and powered down as soon as practicable.
Any user account credentials that may have been compromised should be reset on a clean device
Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Network indicators

IP addresses

104[.]168[.]174[.]32
104[.]168[.]198[.]208
104[.]168[.]201[.]35
104[.]168[.]201[.]47
104[.]168[.]215[.]54
104[.]18[.]40[.]94
149[.]56[.]245[.]196
173[.]209[.]43[.]61
192[.]119[.]106[.]235
192[.]99[.]172[.]143
193[.]36[.]237[.]173
37[.]1[.]213[.]9
37[.]252[.]7[.]142
5[.]199[.]167[.]188
54[.]39[.]233[.]188
91[.]208[.]184[.]174
91[.]218[.]114[.]11
91[.]218[.]114[.]25
91[.]218[.]114[.]26
91[.]218[.]114[.]31
91[.]218[.]114[.]32
91[.]218[.]114[.]37
91[.]218[.]114[.]38
91[.]218[.]114[.]4
91[.]218[.]114[.]77
91[.]218[.]114[.]79
92[.]63[.]11[.]151
92[.]63[.]15[.]56
92[.]63[.]15[.]6
92[.]63[.]15[.]6
92[.]63[.]15[.]8
92[.]63[.]15[.]8
92[.]63[.]17[.]245
92[.]63[.]194[.]20
92[.]63[.]194[.]3
92[.]63[.]29[.]137
92[.]63[.]32[.]2
92[.]63[.]32[.]2
92[.]63[.]32[.]52
92[.]63[.]32[.]55
92[.]63[.]32[.]57
92[.]63[.]37[.]100
92[.]63[.]8[.]47

URLs

104[.]168[.]174[.]32/wordupd_3[.]0[.]1[.]tmp
104[.]168[.]198[.]208/wordupd[.]tmp
104[.]168[.]201[.]35/dospizdos[.]tmp
104[.]168[.]201[.]47/wordupd[.]tmp
104[.]168[.]215[.]54/wordupd[.]tmp
149[.]56[.]245[.]196/wordupd[.]tmp
192[.]119[.]106[.]235/mswordupd[.]tmp
192[.]119[.]106[.]235/officeupd[.]tmp
192[.]99[.]172[.]143/winupd[.]tmp
54[.]39[.]233[.]188/win163[.]65[.]tmp
91[.]208[.]184[.]174:8079/windef[.]exe
agenziainformazioni[.]icu/wordupd[.]tmp
aoacugmutagkwctu[.]onion
checksoffice[.]me
download-invoice[.]site/Invoice_29557473[.]exe
drivers[.]updatecenter[.]icu
mazedecrypt[.]top
mazenews[.]top
newsmaze[.]top
plaintsotherest[.]net
thesawmeinrew[.]net
updates[.]updatecenter[.]icu

Host indicators

Filenames

17269b5.exe
3686576.exe
4ffcc27.exe
5f83030.exe
8e6ce49.exe
ac2c822.exe
argfdg
arsgt35yy
Attack!.rar
Ave Kim
DECRYPT-FILES.html
Emperor.exe
foo.dat
HONClients.exe
jarvey.exe
jarvey.exe
KarriBillabong.dll
kepstl32.dll
kinput.dll
lckwmi.bat
lckwmi.bat
love.dll
maze.dll
maze.exe
memes.tmp
mrtscp64.exe
mrtscp64.exe
version.dll

MD5 hashes

064058cf092063a5b69ed8fd2a1a04fe
078cf6db38725c37030c79ef73519c0c
0f841c6332c89eaa7cac14c9d5b1d35b
108a298b4ed5b4e77541061f32e55751
11308e450b1f17954f531122a56fae3b
11308e450b1f17954f531122a56fae3b
15d7dd126391b0e7963c562a6cf3992c
1fef99f05bf5ae78a28d521612506057
21a563f958b73d453ad91e251b11855c
27c5ecbb94b84c315d56673a851b6cf9
2f78ff32cbb3c478865a88276248d419
335aba8d135cc2e66549080ec9e8c8b7
3a5a9d40d4592c344920dd082029b362
3bfcba2dd05e1c75f86c008f4d245f62
46b98ee908d08f15137e509e5e69db1b
4ccca6ff9b667a01df55326fcc850219
4f57e35a89e257952c3809211bef78ea
5774f35d180c0702741a46d98190ff37
5df79164b6d0661277f11691121b1d53
658e9deec68cf5d33ee0779f54806cc2
65cf08ffaf12e47de8cd37098aac5b33
7507fe19afbda652e9b2768c10ad639f
76f8f28bd51efa03ab992fdb050c8382
79d137d91be9819930eeb3876e4fbe79
7cbe21495c10534817ed428ddc030fe9
8045b3d2d4a6084f14618b028710ce85
8205a1106ae91d0b0705992d61e84ab2
83b8d994b989f6cbeea3e1a5d68ca5d8
868d604146e7e5cb5995934b085846e3
87239ce48fc8196a5ab66d8562f48f26
89e1ddb8cc86c710ee068d6c6bf300f4
910aa49813ee4cc7e4fa0074db5e454a
9eb13d56c363df67490bcc2149229e4c
a0c5b4adbcd9eb6de9d32537b16c423b
a3a3495ae2fc83479baeaf1878e1ea84
a93b86b2530cc988f801462ead702d84
b02be7a336dcc6635172e0d6ec24c554
b40a9eda37493425782bda4a3d9dad58
b4d6cb4e52bb525ebe43349076a240df
b6786f141148925010122819047d1882
b93616a1ea4f4a131cc0507e6c789f94
bad6fc87a98d1663be0df23aedaf1c62
bd9838d84fd77205011e8b0c2bd711e0
be537a66d01c67076c8491b05866c894
bf2e43ff8542e73c1b27291e0df06afd
c255daaa8abfadc12c9ae8ae2d148b31
c3ce5e8075f506e396ee601f2757a2bd
c818cc38f46c604f8576118f12fd0a63
cebe4799b6aff9cead533536b09fecd1
d2dda72ff2fbbb89bd871c5fc21ee96a
d3eaab616883fcf51dcbdb4769dd86df
d552be44a11d831e874e05cadafe04b6
deebbea18401e8b5e83c410c6d3a8b4e
dfa4631ec2b8459b1041168b1b1d5105
e57ba11045a4b7bc30bd2d33498ef194
e69a8eb94f65480980deaf1ff5a431a6
ef95c48e750c1a3b1af8f5446fa04f54
f04d404d84be66e64a584d425844b926
f457bb5060543db3146291d8c9ad1001
f5ecda7dd8bb1c514f93c09cea8ae00d
f5ef96251f183f7fc63205d8ebf30cbf
f83cef2bf33a4d43e58b771e81af3ecc
fad3c6914d798e29a3fd8e415f1608f4
fba4cbb7167176990d5a8d24e9505f71

SHA256 hashes

0606c6d918e0c02cea5fd85bfeb862c8ffe3eee4ef059cd8d2cd3ff342fdf9d9
19aaa6c900a5642941d4ebc309433e783befa4cccd1a5af8c86f6e257bf0a72e
20ea5a9b5b2e47aa191132ac12c1d6dea6b58d7a0467ea53d48e96f8a79c6acd
3c2be967cbaaafecf8256167ba32d74435c621e566beb06a1ead9d33d7e62d64
3fd37d42d5821a8cbcf930255ca1259a680937e4e7dfa2d535d56121187806c2
4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a
4acba1590552c9b2b82f5a786cedc8a12ca457e355c94f666efef99073827f89
4e1f7d397a07477bc3da1e1185a5960475817e9d04529b5bcc2068830262fa1b
5470f0644589685000154cb7d3f60280acb16e39ca961cce2c016078b303bc1b
67f338c9f15b000aedac1d736fbce1ab27fd72a10d397315ba724b1dccf4e834
6878f7bd90434ac5a76ac2208a5198ce1a60ae20e8505fc110bd8e42b3657d13
6d4836c75092d75f1d3a1d90100f19247473f9b0d7e12602221a7badf7feb29d
7a84d10ac55622cdac25f52170459ae5b8181ee3fc345eb1b1dcbd958b344aa6
92125cc9aec53e2e7d0a67e8a53f0d6cb4a33f9ca73243d66b0397d7ddec907e
94673f34efc32e73523f8435acf0afce782ba4f68e9f71f80afbeb3b917162f3
9845f553ae868cd3f8d8c3f8684d18f226de005ee6b52ad88b353228b788cf73
9ad15385f04a6d8dd58b4390e32d876070e339eee6b8da586852d7467514d1b1
abb36315ed6f708ba60c8cf70fdc0e327f7fbcfdfe33a403827e47a0155d1e4f
b27bfa476a6915e573583c63b1d898913472ed86f224d5c470051359ceff8828
b950db9229db2f37a7eb5368308de3aafcea0fd217c614daedb7f334292d801e
c84b2c7ec20dd835ece13d5ae42b30e02a9e67cc13c831ae81d85b49518387b9
d215134b504790b3a3850e4e28a056a5eb2afdd057828626838507792476a74d
e49225cc26ec911a213eb942d7797e8eec6de3f793abc8bb30f4b89f14e72d96
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
eed70e8b4425aea2c6cd37c06c8789acbc049269d6f56d8968787383e82d23dc
f97bda917e52379ae9fe06605e4f120f9c88aebea38d3b4aeb3c21d476ea4d39
fe0a5682abc92037d79318d3f5bc6a920df2ceafaa5f1869406ee842c422f0e9

Last edited: 30 October 2020 1:56 pm