Analysis
-
max time kernel
126s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
18-03-2024 13:20
General
-
Target
d39cbfca5b4af90e9557d6349d2a68da.exe
-
Size
669KB
-
MD5
d39cbfca5b4af90e9557d6349d2a68da
-
SHA1
9322449f3647b82c920e30bbf95f8ce25f875c7a
-
SHA256
212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887
-
SHA512
0aea822b94e81d1849d1e9713e019784a474885bfbfa6e88c066098cf2cf145706c33a5fcd00a616530a3414492747bdf68ea953433dfa7780bf0edf6b3f9ee7
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DrKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWGKrKe
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d39cbfca5b4af90e9557d6349d2a68da.exe"C:\Users\Admin\AppData\Local\Temp\d39cbfca5b4af90e9557d6349d2a68da.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {179CCC37-5B2D-4B68-B118-0D0891BC1F50} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5d1341cd1b8f8ec9196bb2d2c9d4ba113
SHA1aaef4ec7e7b649a9d40799114362839dc887bd3c
SHA256413af1a6042f99c8a9b7a65d6c95b290a5de8b177a675eadd73b9986866aaa99
SHA5127840c0e5d354bf990dbc3077569d4d12e112fddf31a5c52e5372303a6c106c8e1fa39287e4fe08fa8d7873070329ce63d7423afeac0b552a4ced7721ae6d155e
-
Filesize
669KB
MD5d39cbfca5b4af90e9557d6349d2a68da
SHA19322449f3647b82c920e30bbf95f8ce25f875c7a
SHA256212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887
SHA5120aea822b94e81d1849d1e9713e019784a474885bfbfa6e88c066098cf2cf145706c33a5fcd00a616530a3414492747bdf68ea953433dfa7780bf0edf6b3f9ee7
-
Filesize
536B
MD5b4cc0af3f40fc56e1fb1cbeb9390df35
SHA127f5505831ed9008d465a8682dbfdb2a9ca216c2
SHA256f9491e7dbdabb9bf2a1c5c9e18ba78df07b9f7cd36263c02e0018924d1a4e03f
SHA512b1e53c8b7b6e6c5f872384396bf84b27f6b5c931daac505657f3a0f8950d1d6d34292bf4cef1ccb4948bb76e229f9394b7bdc11fa73629bce6daa1556364fa11