Analysis

  • max time kernel
    146s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    20-10-2021 09:40

General

  • Target

    B.exe

  • Size

    669KB

  • MD5

    c17b2c3980926b02136c0a5fb5dfdaa3

  • SHA1

    938eb1b7f1d985d134957443d4c43ad551727b89

  • SHA256

    4d2b250eb1691bd116eb0004a6b4526afe62631551d6d31d4da482ab5ec3b021

  • SHA512

    f770b1dfd74e58ff9d67f0e91ac070e92251598efc45863acf827098cc52f2868c7e2698fd5b0a3a178ea1d1446d32882dfd0601526dbfb27df1251d76c5881b

Malware Config

Extracted

Path

\??\Z:\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">2AA3FB9DAEE617228608CF4231C89769B639B360F3DE50E53444A777CB728DE887BEFDF74D6EBB782E2FAF84A430C3E71A717653D779A1B08A4999D0896DF340<br>99E312C798939E4512F9F12C227FFACAAEDEAED4CDAAF81673577F75AB3090AAB8DE42A9A3989BA9D811FEEA110972DB796A7185359BE2E5CD888DF75C80<br>D1AB0DEA83245E513E66F2E5556BA372474C36A9EDB8A3DC837E3CC117EA22F976ACA46E26D93456DE0DE9543ED880436F8529C6A6BAA8FD6642AAA2DEF6<br>17E95EF1FA4CAA65682EF2602F9A0415EAA9FE84DE36975E4AD20EAB19321B0ABB2F096857E28A07A4CE33552493BAB726A155DB46AD1B72D0EB7545278B<br>865BE9361A3DA031F35D0C4F4D901F761CBC070B46B8F4A37794BDE6885C0484FCA4F75BCBBA428C84265DCC53F7D652350196C4E56318753CE1102B11A3<br>39911B790843062898DEBFEBE407AC2E58148EBC66D307483257A2795232077816023880B96F1F23C7BEDDA5FE3FAD0FA3CCF2A0585527DE9580FB113DE8<br>723E663261AE6BEE48678E221F8D753D98764445E19631C164A25D85308E24AD4C0914F368F4F7801F8D054F1D68EA6AAB8A6335094EFA60193565F08448<br>CF8E060FFFB31EDE6326F27D0644A54467C8E49C6CB5FBFA811B0C9A920E95204F50266B7EAEC29CE5C9E9E4B7E083914185898F5C29D0FD383ABE7EDF95<br>A56229B9AA65003D516D09F82E4C</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>.onion </a><br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="behappy123456@cock.li ">behappy123456@cock.li </a> <br><a href="chinchoppa2299gayspilsss@yopmail.com">chinchoppa2299gayspilsss@yopmail.com</a> <br> <b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>
Emails

href="behappy123456@cock.li

">behappy123456@cock.li

href="chinchoppa2299gayspilsss@yopmail.com">chinchoppa2299gayspilsss@yopmail.com</a>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

  • MedusaLocker Payload 2 IoCs
  • UAC bypass 3 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\B.exe
    "C:\Users\Admin\AppData\Local\Temp\B.exe"
    1⤵
    • Modifies extensions of user files
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1336
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:1748
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:804
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:1436
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:960
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:1448
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1064
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:864
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {5E33AC41-F259-40B2-98A8-E1EEE5668A26} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Roaming\svhost.exe
      C:\Users\Admin\AppData\Roaming\svhost.exe
      2⤵
      • Executes dropped EXE
      PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    MD5

    c17b2c3980926b02136c0a5fb5dfdaa3

    SHA1

    938eb1b7f1d985d134957443d4c43ad551727b89

    SHA256

    4d2b250eb1691bd116eb0004a6b4526afe62631551d6d31d4da482ab5ec3b021

    SHA512

    f770b1dfd74e58ff9d67f0e91ac070e92251598efc45863acf827098cc52f2868c7e2698fd5b0a3a178ea1d1446d32882dfd0601526dbfb27df1251d76c5881b

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    MD5

    c17b2c3980926b02136c0a5fb5dfdaa3

    SHA1

    938eb1b7f1d985d134957443d4c43ad551727b89

    SHA256

    4d2b250eb1691bd116eb0004a6b4526afe62631551d6d31d4da482ab5ec3b021

    SHA512

    f770b1dfd74e58ff9d67f0e91ac070e92251598efc45863acf827098cc52f2868c7e2698fd5b0a3a178ea1d1446d32882dfd0601526dbfb27df1251d76c5881b

  • memory/804-56-0x0000000000000000-mapping.dmp
  • memory/884-62-0x0000000000000000-mapping.dmp
  • memory/960-58-0x0000000000000000-mapping.dmp
  • memory/1064-60-0x0000000000000000-mapping.dmp
  • memory/1336-54-0x0000000075B71000-0x0000000075B73000-memory.dmp
    Filesize

    8KB

  • memory/1436-57-0x0000000000000000-mapping.dmp
  • memory/1448-59-0x0000000000000000-mapping.dmp
  • memory/1748-55-0x0000000000000000-mapping.dmp