Overview

overview

10

Static

static

10

1bc0575b3f...81.exe

windows7-x64

10

1bc0575b3f...81.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2023, 02:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
  • Size 235KB
  • Sample230408-c5ppkade9z
  • SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
medusalockerevasionransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

  • \Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">59F5CB0F8FD311B10AB3E3CF06C4D9165F664FB05EDBD47A87CD70E05C56EAAAD896634ABC4E03359DE2F41C157C89498A2B4E2F3D1E46A527D59A00F5A59EB7<br>F7BEFFE08565A0D02DA0CC705BFBD64ACFA252EB941F1C9EB37E6D996A8D0123C7D9E0C9B0FB4392E2C5194D448C63B37FAD71500B7074AE98843D5CA5AF<br>439593E7F8553854B0B9B71F91BA9958C9AFF4318F9B976660940EAC0F4C6F8C3DAC31A50C684A96793FBC55029276E6947F83BD2CFC0B46A676B1D5D38D<br>D5D925711F4483338E4FF3127B905D9BFFD43F66859C245ADE9551648F1B1AA968D8D953E28E81C9050DDA688C33E8D2D1CB8C5A863B589CA56285AA44A4<br>756368406176A9A2118D483B1583F3A403C0838C5F4D52F4E2D2F812568361622D24CB44CD30C65D141F75AFBB5425AF9350011DB5DE6D9311B5966ABDDA<br>D4036508E27E8CD08F44D0120FD6953DABD78FC77618C2C2B71021065140F83553CB078AA978895A73CE7C096A360636D57F34587D44DDFDA0AD98921527<br>A2A2EE5E5EC3A39B9DDEA599CB1945C6C85646B73D9EE33EEBB43FB2AE4439AC93FFEA768B1E0B0D690754D4DF0E507B6FC3DCD7BDDAD43D24460CED450D<br>C91C3060828227209DDF0FBA9B50AFA48A6B4333F7AC2EB259561ECFCA6811A0FE3F4EA9A042FDF23B868A49E915D144607AF8314E7703B7F691DA4EAE27<br>9A492AE43709708851792AA12DA7</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 14 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
    "C:\Users\Admin\AppData\Local\Temp\1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe"
    1⤵
    • UAC bypass
    • Modifies extensions of user files
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4868
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2124
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2024
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3836
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    PID:3484

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        svhost.exe
        • Path C:\Users\Admin\AppData\Roaming\svhost.exe
        • Size 235KB
        • SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        svhost.exe
        • Path C:\Users\Admin\AppData\Roaming\svhost.exe
        • Size 235KB
        • SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ntuser.dat.LOG2
        • Path C:\Users\Default\ntuser.dat.LOG2
        • Size 536B
        • SHA256 d63c838a1918128659896b7de5fa35919c3745a20092a11251c7a4e4f3a9169a
        • MD5 SHA1 SHA512
        Submit Download

        HOW_TO_RECOVER_DATA.html
        • Path \Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
        • Size 4KB
        • SHA256 c67d98964c84ef222b8e5115100ac8b8e1646d0c80106581ec84f2e1b33db1d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3484-717-0x0000000000E00000-0x0000000000EB2000-memory.dmp
        Download

        memory/4868-713-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-176-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-175-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-711-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-133-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-718-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-719-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-721-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-722-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-723-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-724-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-725-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download

        memory/4868-726-0x0000000000D70000-0x0000000000E22000-memory.dmp
        Download