MITRE ATT&CKsoftware (malware)

S0449 Maze

Published 2020-05-18 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2020-05-18

Description

Maze ransomware, previously known as "ChaCha", was discovered in May 2019. In addition to encrypting files on victim machines for impact, Maze operators conduct information stealing campaigns prior to encryption and post the information online to extort affected companies.

Related

Uses · MITRE ATT&CK (23)

  • T1685 Disable or Modify Tools technique
  • T1027.016 Junk Code Insertion sub-technique
  • T1614.001 System Language Discovery sub-technique
  • T1564.006 Run Virtual Instance sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1568 Dynamic Resolution technique
  • T1059.003 Windows Command Shell sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1218.007 Msiexec sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1529 System Shutdown/Reboot technique
  • T1490 Inhibit System Recovery technique
  • T1489 Service Stop technique
  • T1486 Data Encrypted for Impact technique
  • T1027 Obfuscated Files or Information technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
  • T1057 Process Discovery technique
  • T1070 Indicator Removal technique
  • T1082 System Information Discovery technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (2)

References