Sophos Maze VM September 2020

Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.

Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.

Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.

Maze has injected the malware DLL into a target process.

The Maze encryption process has used batch scripts with various commands.

Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.

Maze has stopped SQL services to ensure it can encrypt any database.

Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.

Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.

Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.

Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.

Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.