Maze

How Maze typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Maze.

1. T1047 Windows Management Instrumentation Execution

   What they do: Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

2. T1053.005 Scheduled Task ExecutionPersistencePrivilege Escalation

   What they do: Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.

   What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

3. T1059.003 Windows Command Shell Execution

   What they do: The Maze encryption process has used batch scripts with various commands.

   What that means: Adversaries may abuse the Windows command shell for execution.

4. T1106 Native API Execution

   What they do: Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

5. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

6. T1055.001 Dynamic-link Library Injection Privilege EscalationStealth

   What they do: Maze has injected the malware DLL into a target process.

   What that means: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

7. T1027 Obfuscated Files or Information Stealth

   What they do: Maze has decrypted strings and other important information during the encryption process.

   What that means: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

8. T1027.016 Junk Code Insertion Stealth

   What they do: Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.

   What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

9. T1036.004 Masquerade Task or Service Stealth

   What they do: Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.

   What that means: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

10. T1070 Indicator Removal Stealth

    What they do: Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.

    What that means: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity.

11. T1218.007 Msiexec Stealth

    What they do: Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.

    What that means: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.

12. T1564.006 Run Virtual Instance Stealth

    What they do: Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.

    What that means: Adversaries may carry out malicious operations using a virtual instance to avoid detection.

13. T1685 Disable or Modify Tools Defense Impairment

    What they do: Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

14. T1049 System Network Connections Discovery Discovery

    What they do: Maze has used the "WNetOpenEnumW", "WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine.

    What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

15. T1057 Process Discovery Discovery

    What they do: Maze has gathered all of the running system processes.

    What that means: Adversaries may attempt to get information about running processes on a system.

16. T1082 System Information Discovery Discovery

    What they do: Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

17. T1614.001 System Language Discovery Discovery

    What they do: Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.

    What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

18. T1071.001 Web Protocols Command and Control

    What they do: Maze has communicated to hard-coded IP addresses via HTTP.

    What that means: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

19. T1568 Dynamic Resolution Command and Control

    What they do: Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.

    What that means: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

20. T1486 Data Encrypted for Impact Impact

    What they do: Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

21. T1489 Service Stop Impact

    What they do: Maze has stopped SQL services to ensure it can encrypt any database.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

22. T1490 Inhibit System Recovery Impact

    What they do: Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

23. T1529 System Shutdown/Reboot Impact

    What they do: Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.

    What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Software Maze has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

The note this group leaves on a compromised machine. Click a filename to read it.

Attention!

----------------------------
| What happened?
----------------------------

All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms.
You cannot access the files right now. But do not worry. You have a chance! It is easy to recover in a few steps.

----------------------------
| How to get my files back?
----------------------------

The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers. 
To contact us and purchase the key you have to visit our website in a hidden TOR network.

There are general 2 ways to reach us:

1) [Recommended] Using hidden TOR network.

  a) Download a special TOR browser: https://www.torproject.org/
  b) Install the TOR Browser.
  c) Open the TOR Browser.
  d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/[snip]
  e) Follow the instructions on this page. 

2) If you have any problems connecting or using TOR network

  a) Open our website: https://mazedecrypt.top/[snip]
  b) Follow the instructions on this page.

Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use. 

On this page, you will see instructions on how to make a free decryption test and how to pay.
Also it has a live chat with our operators and support team.

----------------------------
| What about guarantees?
----------------------------

We understand your stress and worry.
So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer!
If you have any problems our friendly support team is always here to assist you in a live chat!


-------------------------------------------------------------------------------
THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU
---BEGIN MAZE KEY---
[snip]
---END MAZE KEY---

Ransom-note text from RansomLook, licensed CC BY 4.0.