Analysis
-
max time kernel
55s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
20-03-2023 21:33
General
-
Target
1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
-
Size
669KB
-
MD5
3618b68d7db4614ec8d33b5052cc0e85
-
SHA1
15177fbb65d707b308bac50f612b795494314001
-
SHA256
1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f
-
SHA512
d6ab35314f9388cafc340edc4476f374faddf6b0905d736356be32fc3e77cb2baa09fedc13af5a43c10fb4631cc77e766b530e58fa47f98329e9e2371cdd7e8d
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DHKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWaKrKe
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe"C:\Users\Admin\AppData\Local\Temp\1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD523439bd5e6f5d1bcc4c919e5e8715470
SHA180415186bc8706d461ab3a69c8fbeb9629e97919
SHA256696333cc2a8fee513114c29c2f01043fb2c83001fe2ec07b93b383742ce12e53
SHA512815f159a67746f2084fbb58b1fe2f7d1de653f08c4f77b6bd157d3a8f8cb016a6c44a86e197f977027ec28c4c531d6c5e27d7e5e8b95d38aa016e3b80fd2de7e
-
Filesize
536B
MD5e7b44f6b2b1738ed5aee2437eb95a8ca
SHA113ebee0255eff59844ad79889178850005f8fb8e
SHA256292ecdac5e05a678b421c32280cbec2423a064177bee5453c4cb09fccfb40342
SHA51275e71e15e8e4e42cdf8c7a61adbb0c52aab275359962877f30e28d173b0d87795ca3d2ae17ec3ebb2c667e65f22c479d248ed4ca64cbe895ab259edf71d8bd4d