Overview

overview

10

Static

static

10

cbdfaf7c90...ad.exe

windows7-x64

10

cbdfaf7c90...ad.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2022 07:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe

  • Size

    710KB

  • MD5

    674a54ed8c9614aea4808f6a09cc2236

  • SHA1

    10e78765c5b245a6d19e77f54cb40bcdbb91ddcd

  • SHA256

    cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad

  • SHA512

    fb513afef9f44834e6461645a7f3121a343f07074f91b1e999faabeca332898f45426a67e70944ad979f80aa149eff5006547cc7b2ccb06af1a08b08df537ae1

  • SSDEEP

    12288:XA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DXKD/KeXQF:wuf4wTuV2Ux3uIZeUBi2Te6HWCKrKea

Score
10/10
medusalockerneshtaevasionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 7 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Executes dropped EXE 4 IoCs
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
    "C:\Users\Admin\AppData\Local\Temp\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1192
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1280
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4180
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4352
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
        3⤵
        • Executes dropped EXE
        PID:4108

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\WindowsApps\
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
    Filesize

    669KB

    MD5

    ac546514c037b432430bebc8e3884dad

    SHA1

    f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

    SHA256

    b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

    SHA512

    b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad.exe
    Filesize

    669KB

    MD5

    ac546514c037b432430bebc8e3884dad

    SHA1

    f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

    SHA256

    b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

    SHA512

    b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
    Filesize

    669KB

    MD5

    ac546514c037b432430bebc8e3884dad

    SHA1

    f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

    SHA256

    b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

    SHA512

    b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
    Filesize

    669KB

    MD5

    ac546514c037b432430bebc8e3884dad

    SHA1

    f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d

    SHA256

    b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009

    SHA512

    b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
    Filesize

    8B

    MD5

    2eb1f83b03271e42c9fbcf6092435088

    SHA1

    0a834c6d6dae42dc108d8884f37a0b38288d4d0f

    SHA256

    246351ce4f313487b65dbbc03c6109d934943e230794bdb17509b3007466285b

    SHA512

    ac2ddf8c14e5c58efcd2897d76080acf79fe2cdb1e9475c0bb398dbffa57e97faeaacaec721a51855222b5220c3a8477883b290dbd6d99344a64dcf0f43b7409

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    710KB

    MD5

    f80a0f5400ca81250c66efe2e927ddcd

    SHA1

    b489cb6aae676c9d5510a69d2f856d2102994b71

    SHA256

    2a42544a17aee8744980b0c637346a5003b4cd8cdd0e3209423421ff17efaffe

    SHA512

    46d0826b1ca83c3c7f6e2385e1f5a341354eede5f575f43ee4cebcc2eb20ff1837467b1386a019a5af6b06065dae0225f80d2f16943d5fb42167fbcd10dc41f4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    710KB

    MD5

    674a54ed8c9614aea4808f6a09cc2236

    SHA1

    10e78765c5b245a6d19e77f54cb40bcdbb91ddcd

    SHA256

    cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad

    SHA512

    fb513afef9f44834e6461645a7f3121a343f07074f91b1e999faabeca332898f45426a67e70944ad979f80aa149eff5006547cc7b2ccb06af1a08b08df537ae1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    710KB

    MD5

    674a54ed8c9614aea4808f6a09cc2236

    SHA1

    10e78765c5b245a6d19e77f54cb40bcdbb91ddcd

    SHA256

    cbdfaf7c90928949e71d8666a296fa211bb42f47cf33b41b1f8c6e439323f2ad

    SHA512

    fb513afef9f44834e6461645a7f3121a343f07074f91b1e999faabeca332898f45426a67e70944ad979f80aa149eff5006547cc7b2ccb06af1a08b08df537ae1

    Download Submit

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

    Download Submit

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

    Download Submit

  • memory/1192-132-0x0000000000000000-mapping.dmp

    Download

  • memory/1280-135-0x0000000000000000-mapping.dmp

    Download

  • memory/1700-142-0x0000000000000000-mapping.dmp

    Download

  • memory/4108-147-0x0000000000000000-mapping.dmp

    Download

  • memory/4180-136-0x0000000000000000-mapping.dmp

    Download

  • memory/4352-137-0x0000000000000000-mapping.dmp

    Download