Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
06-04-2023 21:27
General
-
Target
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
-
Size
235KB
-
MD5
f6f120d1262b88f79debb5d848ac7db9
-
SHA1
1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
-
SHA256
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
-
SHA512
1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
-
SSDEEP
6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Extracted
C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html
medusalocker
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 12 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 38 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe"C:\Users\Admin\AppData\Local\Temp\1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SaveTrace.wmv.marlock071⤵
- Modifies registry class
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D5F9DB93-9A6F-4F95-AADF-E493039222D6} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD560aaa4ff040fd3122ba7c39efbd2ab74
SHA1f515ad71cf8b99ba126c52cd80320f681b431eec
SHA256fb3e50519dd4874937db1805b00df0c223bce104359573320e04e83a3dfd27b2
SHA5122150fe572c8448552d22b052ccfa0516e1d2597eee4212432c174f4a619d8aeb28d9c62900c2127b999b4ddf8c5b94c501512b7888a276e08be8e6ec702ff0d2
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
342B
MD57571e36cf0a9eff89fd97459079fb906
SHA1269398b1fdc15fe4610afd9223c852e05b895e28
SHA256992c2aec79d014a410e3f7d6b138aa09af5a762a9ab973f3274d9a6ca408a2bb
SHA512b55dc322cecc8cd4ca0a2edf174303a0a99869cc17db2620a86f61008d067247827acf9640522c1d972a0341f37cdb7fbddc6081c0ad1366117e60ebd63dc6d8
-
Filesize
342B
MD537b0023f47ebcd19455f5e9d4d57b263
SHA197cb4de8cd95d640d7ee5ef761130a8ce894a6a5
SHA256ad2eb1362d294f5debaad1fd5dd3668beb60c3a584160688d1e0b78858d899e7
SHA5125e5303aa092ec9f44049447adb5cc6c05b39700650230d556324e4fdca8bd46528f4657e3bf645e51264a34ecc074b751e7f7acd5f7a5ab988168f6e1399e1a1
-
Filesize
342B
MD51fd6f93db983e2cdcda148c6818a2725
SHA1f57a0d3232c7ca71ab907d7d5b75ab7da5e8c7c3
SHA25628b00cbefe6ca1324cd7512e761425f6b0e904c6828e920ff052b93c1bf3f681
SHA51261aabc02837e7c3c230f29d925e0f38af4ea9d9e059784656cfe9f99e6262a950199fc363e12295080b8b03aaf7e2195d57b489c88d66e41ab001c1921b42689
-
Filesize
342B
MD5c87523b1162519b8d8f495428811b511
SHA18d61e66f7dea84e993c88c695ca42b61d91949fe
SHA2568ab391695d9b0bc4e3a7a267cbef1d2c66bce48358565db77ba63112df8c5ebb
SHA512b5f3005f335c3eb165e1b655047267967da1f43371d4f2fd032ed7ac9ff9418ca9709f9a9308e5ebd8eeea1aac632141d60ae299ff2dbfbfd0c1e729a54222a1
-
Filesize
342B
MD5af3bee5246e47683332c89474d66cf37
SHA19ac824a5d64ce2b235f116f81b372006e52eea5a
SHA256125b08516c88952fab5d439de68ce1c78b23b4e8a2871044e541c8ccf1105396
SHA5123cfe8908749c2bfaa1f9cd731be4f7cb70a2af8ad6bb6757d53c120e268d18163019b8a65474df24e87d033ebeef21284c287372c099f1b6895857de5caefe41
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
600B
MD5b523f2b16deea2f96f3623fca25a18ef
SHA1ebcee2d0ad3a107e24d7ef20f88d118d865e7685
SHA256f45e4667397e131a30c2fdd0c4c17401384738ecc312749a1dcf53238b0b67a8
SHA51274fec50448b763d7c245e2fffc95e819a42c6f70e17cc6ab46488e596b52227a4302254a5bf3cbec56b2e9c1f19da8899452164200beb07bad13af75f7057276
-
Filesize
235KB
MD5f6f120d1262b88f79debb5d848ac7db9
SHA11339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA2561bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA5121067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
-
Filesize
235KB
MD5f6f120d1262b88f79debb5d848ac7db9
SHA11339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA2561bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA5121067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
-
Filesize
4KB
MD560aaa4ff040fd3122ba7c39efbd2ab74
SHA1f515ad71cf8b99ba126c52cd80320f681b431eec
SHA256fb3e50519dd4874937db1805b00df0c223bce104359573320e04e83a3dfd27b2
SHA5122150fe572c8448552d22b052ccfa0516e1d2597eee4212432c174f4a619d8aeb28d9c62900c2127b999b4ddf8c5b94c501512b7888a276e08be8e6ec702ff0d2
-
Filesize
536B
MD54a61c3655c811fdfdbc5c5410b4f7931
SHA1be0bc6b3393846c0ba478f20c4d2a75401105dde
SHA256c55785523bc0596ded27dfbf3960c45e2aa0e7b001471af6f32d936f34b28d5d
SHA51264c335718bfdf28ebc62f2af692fc3e156d53240506e6a3d7de500ea4aff0eab609fb24469a2aa9f1d6a7dbe370c354689078505f21f843aed1cd42a34cf989b
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB