Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 00:08
General
-
Target
2120cf93b6be39884f951ee2a31c5999.exe
-
Size
669KB
-
MD5
2120cf93b6be39884f951ee2a31c5999
-
SHA1
317b695da0ece90979f0400c2c7800e50bec8bb9
-
SHA256
c5bef2a489740192a0b2c34cdc2fd954d0b8d5fabcbe0ecb8b78f9301e5a30a6
-
SHA512
3038b27dcc263675a642f77d9dbaaff921c3a56f160051df44619dbafcd5d108db1c6caeacb70179c511e284035d329f29c34dd19500d2bd4006d2f86ee1dc33
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DKKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWjKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999.exe"C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5c89c7f4705acb628e00c56966b54f0af
SHA191584344b182ef6f8be2a11b9c3255207c717036
SHA256cd8925980225ea79877b4549a7ef2cf8304596e9f1d6cdbfaa08ef8e3a3257f0
SHA512906db0dc9225862039091addfb6c6355103840f97b295841fc88e0fe9b7f6111b636e5d36ef5ec43e31e3591fe49cfdc4136bc89b706d2f491333c43bfb7d2f4
-
Filesize
512KB
MD5cd9e3ef4cc999ccf5e2d1f74f0fe7c2e
SHA1c1ba28484f8ceca2d72bc1e59dd0d27ed8fb39dd
SHA25619a7051ea375406e484094bcb50435d26259efed5afe64820ca104443f8d571c
SHA5125d487e8a9e577c8adb74d6b8baacd76218ee72c535fbbb07aa799aba6efd9ba197de9348fc862527843114eff72b69a3191f77e52c708b83dab554f167c0f805
-
Filesize
536B
MD5970efbc8c22efc6988079c40fb83239c
SHA1817582fad58a43426061d914064e2d48dd48c01b
SHA256f7ba1a8aac83b8e7dc790bd7f3377fd9de937f3217e4347639660a1af5c5e902
SHA5125763b4f3a02914454a1f8a61bbba031c753a40a8c9055d217ebb753f10fb0988a7ef45b7930d907c19fabb5cd3a67032579ba4e3c935111a3158bde3c8f2bdb3
-
Filesize
5KB
MD5a1e8bb1c6b4e9016e7058279fb324b8f
SHA19f1f16755a0f0a73be07e4f000fc41e8ebc862d7
SHA256ed5b5e37f0a95d8e348a4672d7807b2e7a47fa69ba2cc1dafb40987716aa91f4
SHA512862050e79159bebd00e17439e8dda7ff2ec7876fef74e03119dfb655dbda7bc40907f40174a8aadf8255ee17a112a80163f74e806fbaeef253e3b4d6eb87a0c2