Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
06-11-2023 13:22
General
-
Target
14263-Q-CTI.exe
-
Size
669KB
-
MD5
ca74bacf835fc1effa36a5c7966c18b5
-
SHA1
cd2ca5370811e30999225d15d0eaebbc889db513
-
SHA256
3964c77cba25aa842d89dc9a6ac1c50c473fec97f0f798d8fb815d76dd1257cf
-
SHA512
aab1de901b5a5a47e9ba91bf99483462e3e765ab610346d1a8582fe3d5a432dbedaf80c23a4752a6e6de13db4e5913b2e89073cdcb610d26e1f0fb7ad052d872
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DOKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWHKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\HOW_TO_BACK_FILES.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14263-Q-CTI.exe"C:\Users\Admin\AppData\Local\Temp\14263-Q-CTI.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD5ca74bacf835fc1effa36a5c7966c18b5
SHA1cd2ca5370811e30999225d15d0eaebbc889db513
SHA2563964c77cba25aa842d89dc9a6ac1c50c473fec97f0f798d8fb815d76dd1257cf
SHA512aab1de901b5a5a47e9ba91bf99483462e3e765ab610346d1a8582fe3d5a432dbedaf80c23a4752a6e6de13db4e5913b2e89073cdcb610d26e1f0fb7ad052d872
-
Filesize
669KB
MD5ca74bacf835fc1effa36a5c7966c18b5
SHA1cd2ca5370811e30999225d15d0eaebbc889db513
SHA2563964c77cba25aa842d89dc9a6ac1c50c473fec97f0f798d8fb815d76dd1257cf
SHA512aab1de901b5a5a47e9ba91bf99483462e3e765ab610346d1a8582fe3d5a432dbedaf80c23a4752a6e6de13db4e5913b2e89073cdcb610d26e1f0fb7ad052d872
-
Filesize
536B
MD5e1db5186d490f1eba52bed51df45b123
SHA15b9a1acc6757432f94f997ffa5a46739f3456b76
SHA256e8d2f77eb3142ee1e936992dd32dd1738c900266a89b743dbae06665a562dcd7
SHA5129df793e05b13277e3cf7877fabe585d65acd936ed64cb82d5cb6f015f9f7bb3cd051c7b6a91d239277e59c48302abb19c243e79586aa79ac6c1e9a61409605a8
-
Filesize
4KB
MD50bc7db252c046951d323439e460cf0a4
SHA1a032bf45684ad35b283845648a6c1e8571058890
SHA2567074bf2e1b46de8ba29cca656fdfec8a289b619700ef5a6010e90e89bf8ab8e1
SHA5122fcf2980745e6dae2fd59853069c3545f4707839446c774c4a76468b31622f927c7d650923899b660dcb8220be1134e00c97318eb72c105156f5e6c1c8861934