Overview

overview

10

Static

static

10

b2493a5801...49.exe

windows7-x64

10

b2493a5801...49.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2022 05:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe

  • Size

    719KB

  • MD5

    8474039d83805eb7b447325c3a8d1ebb

  • SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

  • SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

  • SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

  • SSDEEP

    12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6

Score
10/10
medusalockerneshtaevasionpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">3CF61751DD2CA96BC4BDF46A3EDE2658383D739A8CE3CB774A3AC66BAE503059F2AF8022FDF2C1489D742B876B41B49B86EA3E15744D761AE5E73967B0ECFFFA<br>5BDB67994C5EDFD9AB4AE06AC0E68709C6F348FDCBB702ED19628035DF685E31ECA0A5B3ADEC26F09D6D7791A25E78075786E0D558E4DEB2597D329C59A8<br>F35EE3EA0E66E5F8D87D7A54D797A6FB8A376536A66390B3AF008E54725EE927F42C2D4ABE49952561F4031C12965E898819939ABC1E2BA19DC2DB412E2D<br>9D27608DA369E1AEE3ADEC01AA25536EFB51AF4FA22A2C6A6EA422E79D3788251A7BD470DFE15AFD5F6B153195279B333B7508405B99ADE814330902DEE5<br>2DC12C23E069D237DE2A84FDBFF5B947A031D0E86866A1CB5CF972DA59A655A2DD3749F3A2BC3D281D45ECFF3FB70A396C2065367E86B10DAD122B0BD681<br>6100F524AC887BF6059A36D529B10EFAB85017BC355F1325CE6C987504505E743C183684DE1EEB35FE1B2F5CFFEE71E93DFAB9B94DAF479E821837D1A739<br>7E7327F2EBE1C459A13FB9567DB80F19D55525283093CAD7E3B4CE2EBC1F182956E3BC34BF8F761DDBBDD7F7B77ED0C876C8DB847A576252D7E7A9170E01<br>0E2D9337FD02E03C60629FE35D01EA0F07936E4A6DC8AD0789F7B87379DC98F3B0064DCB45B468DA7BD4E753EEF66CEE147D8A0BCE8DC5DDA1DC174B35FD<br>0DC58EF017C2A3865B2CA2A76B02</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-vktqVZWPMPBUhdlEpqLxDMb4dEDfM0LF</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • Detect Neshta payload 4 IoCs
  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 7 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Executes dropped EXE 4 IoCs
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    "C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4668
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4928
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1656
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:712
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
        3⤵
        • Executes dropped EXE
        PID:4308

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    Filesize

    678KB

    MD5

    5aa0a571567f8437556e9b00ae5a3532

    SHA1

    45377cb152832c9112db7909219fa87a6e760aae

    SHA256

    73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432

    SHA512

    d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    Filesize

    678KB

    MD5

    5aa0a571567f8437556e9b00ae5a3532

    SHA1

    45377cb152832c9112db7909219fa87a6e760aae

    SHA256

    73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432

    SHA512

    d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
    Filesize

    678KB

    MD5

    5aa0a571567f8437556e9b00ae5a3532

    SHA1

    45377cb152832c9112db7909219fa87a6e760aae

    SHA256

    73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432

    SHA512

    d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
    Filesize

    678KB

    MD5

    5aa0a571567f8437556e9b00ae5a3532

    SHA1

    45377cb152832c9112db7909219fa87a6e760aae

    SHA256

    73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432

    SHA512

    d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
    Filesize

    8B

    MD5

    136700e73d2aeaa04d8cb039f6f44ed9

    SHA1

    b0db8c6a376b9a37134bf5b7fe6d7c3d1029c8e3

    SHA256

    78570d4bee801a1564e8b8e895d88e0959d0ef6c5827eece5809b2de381afe60

    SHA512

    1d235adac4561a4717df4f0db6a5ae5486eda1d66cf991de405b551ddd6aef562b613eae1b4a35a2d45c22ef27d01b4c963a9f9d07888229a98496245e450eed

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    719KB

    MD5

    2ac8273b05e34f178afcf5dc706e05ac

    SHA1

    8038be46477e9ee59b0bee9b45da61907e27867f

    SHA256

    48b9a7637d2c6b991bdb15814112d6866cdb20a9472650ab3962db69dba37f06

    SHA512

    cb34c3e17fc3125f2861f47fb50d23e3ab7fdab46231648c06d73a6c46989f659e6b3a973aedd89e4ed6b8afdefce5d5fc059644f3c378f7d2dd12ce420b94a2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    719KB

    MD5

    8474039d83805eb7b447325c3a8d1ebb

    SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

    SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

    SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    719KB

    MD5

    8474039d83805eb7b447325c3a8d1ebb

    SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

    SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

    SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

    Download Submit

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

    Download Submit

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

    Download Submit