Analysis
-
max time kernel
129s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
17-11-2022 06:04
General
-
Target
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
-
Size
719KB
-
MD5
8474039d83805eb7b447325c3a8d1ebb
-
SHA1
a07d537f4253745a087709a9a07c449f84deed8d
-
SHA256
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
SHA512
3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
SSDEEP
12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6
Malware Config
Extracted
C:\Recovery_Instructions.html
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Signatures
-
Detect Neshta payload 5 IoCs
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 7 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
UAC bypass 3 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exeC:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
678KB
MD55aa0a571567f8437556e9b00ae5a3532
SHA145377cb152832c9112db7909219fa87a6e760aae
SHA25673549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
SHA512d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
Filesize
8B
MD51ed531b15f72d7244c9039862cb85551
SHA13f85de7bcbeb3d5f4a02c99abe7ff9f45fa62517
SHA2567f73872b086458a67a5df0f294e15bd0a1c8a64332757f5da05c6c56fec1b59c
SHA5128814baaa30f7aa16805b8fd0c1f8a61a2926fdedf5d938cc0b2daa10807edfbd77720e719a9cde94cb3fe577f2b67b42a6851d89592254b6af180508c3d34f34
-
Filesize
719KB
MD58474039d83805eb7b447325c3a8d1ebb
SHA1a07d537f4253745a087709a9a07c449f84deed8d
SHA256b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
SHA5123272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
Filesize
719KB
MD58474039d83805eb7b447325c3a8d1ebb
SHA1a07d537f4253745a087709a9a07c449f84deed8d
SHA256b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
SHA5123272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
Filesize
719KB
MD58474039d83805eb7b447325c3a8d1ebb
SHA1a07d537f4253745a087709a9a07c449f84deed8d
SHA256b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
SHA5123272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
Filesize
40KB
MD536fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
Filesize
40KB
MD536fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
-
-
-
-
-