Analysis
-
max time kernel
168s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2022 07:01
Behavioral task
behavioral1
Sample
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
-
Size
669KB
-
MD5
ac546514c037b432430bebc8e3884dad
-
SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
-
SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
-
SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DXKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWCKrKe
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000022e0e-135.dat family_medusalocker behavioral2/files/0x0007000000022e0e-136.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Executes dropped EXE 1 IoCs
pid Process 2232 svhost.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\LockBackup.raw => C:\Users\Admin\Pictures\LockBackup.raw.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\LockInitialize.png => C:\Users\Admin\Pictures\LockInitialize.png.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened for modification C:\Users\Admin\Pictures\SendSync.tiff b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\SendSync.tiff => C:\Users\Admin\Pictures\SendSync.tiff.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\GroupResolve.png => C:\Users\Admin\Pictures\GroupResolve.png.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\HideApprove.png => C:\Users\Admin\Pictures\HideApprove.png.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\V: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\Y: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\E: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\H: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\F: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\G: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\I: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\Q: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\A: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\B: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\N: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\O: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\P: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\S: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\U: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\L: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\M: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\T: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\W: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\X: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\Z: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\K: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\R: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4780 wmic.exe Token: SeSecurityPrivilege 4780 wmic.exe Token: SeTakeOwnershipPrivilege 4780 wmic.exe Token: SeLoadDriverPrivilege 4780 wmic.exe Token: SeSystemProfilePrivilege 4780 wmic.exe Token: SeSystemtimePrivilege 4780 wmic.exe Token: SeProfSingleProcessPrivilege 4780 wmic.exe Token: SeIncBasePriorityPrivilege 4780 wmic.exe Token: SeCreatePagefilePrivilege 4780 wmic.exe Token: SeBackupPrivilege 4780 wmic.exe Token: SeRestorePrivilege 4780 wmic.exe Token: SeShutdownPrivilege 4780 wmic.exe Token: SeDebugPrivilege 4780 wmic.exe Token: SeSystemEnvironmentPrivilege 4780 wmic.exe Token: SeRemoteShutdownPrivilege 4780 wmic.exe Token: SeUndockPrivilege 4780 wmic.exe Token: SeManageVolumePrivilege 4780 wmic.exe Token: 33 4780 wmic.exe Token: 34 4780 wmic.exe Token: 35 4780 wmic.exe Token: 36 4780 wmic.exe Token: SeIncreaseQuotaPrivilege 692 wmic.exe Token: SeSecurityPrivilege 692 wmic.exe Token: SeTakeOwnershipPrivilege 692 wmic.exe Token: SeLoadDriverPrivilege 692 wmic.exe Token: SeSystemProfilePrivilege 692 wmic.exe Token: SeSystemtimePrivilege 692 wmic.exe Token: SeProfSingleProcessPrivilege 692 wmic.exe Token: SeIncBasePriorityPrivilege 692 wmic.exe Token: SeCreatePagefilePrivilege 692 wmic.exe Token: SeBackupPrivilege 692 wmic.exe Token: SeRestorePrivilege 692 wmic.exe Token: SeShutdownPrivilege 692 wmic.exe Token: SeDebugPrivilege 692 wmic.exe Token: SeSystemEnvironmentPrivilege 692 wmic.exe Token: SeRemoteShutdownPrivilege 692 wmic.exe Token: SeUndockPrivilege 692 wmic.exe Token: SeManageVolumePrivilege 692 wmic.exe Token: 33 692 wmic.exe Token: 34 692 wmic.exe Token: 35 692 wmic.exe Token: 36 692 wmic.exe Token: SeIncreaseQuotaPrivilege 3760 wmic.exe Token: SeSecurityPrivilege 3760 wmic.exe Token: SeTakeOwnershipPrivilege 3760 wmic.exe Token: SeLoadDriverPrivilege 3760 wmic.exe Token: SeSystemProfilePrivilege 3760 wmic.exe Token: SeSystemtimePrivilege 3760 wmic.exe Token: SeProfSingleProcessPrivilege 3760 wmic.exe Token: SeIncBasePriorityPrivilege 3760 wmic.exe Token: SeCreatePagefilePrivilege 3760 wmic.exe Token: SeBackupPrivilege 3760 wmic.exe Token: SeRestorePrivilege 3760 wmic.exe Token: SeShutdownPrivilege 3760 wmic.exe Token: SeDebugPrivilege 3760 wmic.exe Token: SeSystemEnvironmentPrivilege 3760 wmic.exe Token: SeRemoteShutdownPrivilege 3760 wmic.exe Token: SeUndockPrivilege 3760 wmic.exe Token: SeManageVolumePrivilege 3760 wmic.exe Token: 33 3760 wmic.exe Token: 34 3760 wmic.exe Token: 35 3760 wmic.exe Token: 36 3760 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2296 wrote to memory of 4780 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 81 PID 2296 wrote to memory of 4780 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 81 PID 2296 wrote to memory of 4780 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 81 PID 2296 wrote to memory of 692 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 83 PID 2296 wrote to memory of 692 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 83 PID 2296 wrote to memory of 692 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 83 PID 2296 wrote to memory of 3760 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 85 PID 2296 wrote to memory of 3760 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 85 PID 2296 wrote to memory of 3760 2296 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 85 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe"C:\Users\Admin\AppData\Local\Temp\b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2296 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:692
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:2232
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD5ac546514c037b432430bebc8e3884dad
SHA1f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
SHA256b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
SHA512b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99
-
Filesize
669KB
MD5ac546514c037b432430bebc8e3884dad
SHA1f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
SHA256b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
SHA512b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99