Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
18-04-2023 05:13
General
-
Target
053680ED933D58F4150FFDEFAC4D9F13.exe
-
Size
669KB
-
MD5
053680ed933d58f4150ffdefac4d9f13
-
SHA1
69c4a4ffb650a6fdfe343d6acca3b988647aee30
-
SHA256
af768da08a34ddf503522186a22e65e623491e48754356210cc6798598f85266
-
SHA512
4ed454e96f65c2a7cefbe27a499e2fb3eeea8512e704aae7de4245e0a0d38788ec7366937a68a57b714681da3f43ebddf32241756f0f0e6eb63488c8c3966de2
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DnKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWmKrKe
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\053680ED933D58F4150FFDEFAC4D9F13.exe"C:\Users\Admin\AppData\Local\Temp\053680ED933D58F4150FFDEFAC4D9F13.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {53388A83-184A-45AF-9334-2F56063D9E14} S-1-5-21-1283023626-844874658-3193756055-1000:THEQWNRW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD56810ab42d384cc2cc2f7a07ef129eb92
SHA1846beee66cc05de4bd3be68468d074e0bdda6a2f
SHA256151e493a07ed8e64ca006c990dfecdd66f9ed40c7ad17cd94b0fe82772b48965
SHA5120cfb79147da820654e241dfbfb5314c06f275d10e6d1e6d31c220e5a1dc8edfe37ee9011c0e276d924fb227a222a7ff49a2fc7d2d0090fc170ca89b66a043e4e
-
Filesize
669KB
MD5053680ed933d58f4150ffdefac4d9f13
SHA169c4a4ffb650a6fdfe343d6acca3b988647aee30
SHA256af768da08a34ddf503522186a22e65e623491e48754356210cc6798598f85266
SHA5124ed454e96f65c2a7cefbe27a499e2fb3eeea8512e704aae7de4245e0a0d38788ec7366937a68a57b714681da3f43ebddf32241756f0f0e6eb63488c8c3966de2
-
Filesize
669KB
MD5053680ed933d58f4150ffdefac4d9f13
SHA169c4a4ffb650a6fdfe343d6acca3b988647aee30
SHA256af768da08a34ddf503522186a22e65e623491e48754356210cc6798598f85266
SHA5124ed454e96f65c2a7cefbe27a499e2fb3eeea8512e704aae7de4245e0a0d38788ec7366937a68a57b714681da3f43ebddf32241756f0f0e6eb63488c8c3966de2
-
Filesize
536B
MD596e9f8850bf63462a19f9ad28af788b5
SHA1a563a62613303c95433d6d034dc7eaa83a8c0ce1
SHA25661e3c3a8ee8aa9218625745aabf7550361d791d6d348e283eb67c307a943bd13
SHA512bf033f06e19e8af384d2e2ca634f27910d19bc9ef2140c0868740570b32e6a236922b3c140383c52da7a2051c7e12eb60da09bddaa0b577dbb8438268c8d74ad