Overview

overview

10

Static

static

10

add2850732...6b.exe

windows7-x64

10

add2850732...6b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    11-03-2023 01:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b.exe

  • Size

    678KB

  • MD5

    168447d837fc71deeee9f6c15e22d4f4

  • SHA1

    80ad29680cb8cecf58d870ee675b155fc616097f

  • SHA256

    add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b

  • SHA512

    f8e123b601b5df3e89109fcc2e215e014b0d99b382d7cfb1a8cfd55790525c4e5504ee668ac30108c1bebf32e312e0c33edb5737c7ae166b59f791269bd66112

  • SSDEEP

    12288:cPJ4U1TYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuDJVoM7:J6TYVQ2qZ7aSgLwuVfstRJLIYM

Score
10/10
medusalockerevasionransomwarespywarestealertrojan

Malware Config

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 2 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b.exe
    "C:\Users\Admin\AppData\Local\Temp\add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b.exe"
    1⤵
    • UAC bypass
    • Modifies extensions of user files
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1716
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:472
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1120
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:888
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1540
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:832
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:836
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:704
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {6DA5E91F-DE61-4627-AD9C-E70EBFE7C5D1} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Roaming\svhost.exe
      C:\Users\Admin\AppData\Roaming\svhost.exe
      2⤵
      • Executes dropped EXE
      PID:1756

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\How_to_back_files.html
    Filesize

    4KB

    MD5

    de10cccbcc909b07eacc4b59921b73e7

    SHA1

    a947c5ef697fd2d77c1478ac842133050b7879a3

    SHA256

    7a7cbc81b59ee91e7f691a7d7a5c9bc62e9c58166df6f0bb8a4435be2bd6fe81

    SHA512

    7cd5c9959661e26df6099ae104e1660538cc8a67ec0570f7ff946f85226c876ed58392df4d05a905d7d3fe48b66a9c3b106af035cfc7ed5a55a460c7f2f147cf

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    678KB

    MD5

    168447d837fc71deeee9f6c15e22d4f4

    SHA1

    80ad29680cb8cecf58d870ee675b155fc616097f

    SHA256

    add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b

    SHA512

    f8e123b601b5df3e89109fcc2e215e014b0d99b382d7cfb1a8cfd55790525c4e5504ee668ac30108c1bebf32e312e0c33edb5737c7ae166b59f791269bd66112

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    678KB

    MD5

    168447d837fc71deeee9f6c15e22d4f4

    SHA1

    80ad29680cb8cecf58d870ee675b155fc616097f

    SHA256

    add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b

    SHA512

    f8e123b601b5df3e89109fcc2e215e014b0d99b382d7cfb1a8cfd55790525c4e5504ee668ac30108c1bebf32e312e0c33edb5737c7ae166b59f791269bd66112

    Download Submit

  • C:\Users\Default\NTUSER.DAT.LOG2
    Filesize

    536B

    MD5

    7ef205c3b27313f46e5b6cae7caf7b0f

    SHA1

    6414d16bb727a3f2bbc5e00fe599bdbb6bdd64f4

    SHA256

    233908203e794bf6da4625e3cf04fd40dd3f757591512f8e8b65cf2dc906b225

    SHA512

    a1d54f14d7ebeba62aef38012dfa940d24e878b347444cae616a902deb839858ff0bb2ff05cbae956b2d97f7c1171d06b482e7c6752fe774e7b7a3154b45aad5

    Download Submit