Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21-04-2024 10:47
General
-
Target
ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe
-
Size
678KB
-
MD5
ff1b2e9d3e7af50b302b090a15d15c76
-
SHA1
3bae4caa7c4ecca659aec342472fe49b3c0b2131
-
SHA256
a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212
-
SHA512
d3527aa4e7d4a8fbd0565ea8c0d26dc7e9ff0f294efa5260b9e964e5943782eb697b964cb684ad9008a717b93cfd120ec1337acb0ecbefef0931313f7b88e881
-
SSDEEP
12288:cPJ4U0TYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuvJVoM7:JzTYVQ2qZ7aSgLwuVfstRJLAYM
Malware Config
Extracted
\Device\HarddiskVolume1\Recovery_Instructions.html
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Renames multiple (164) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff1b2e9d3e7af50b302b090a15d15c76_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
678KB
MD5ff1b2e9d3e7af50b302b090a15d15c76
SHA13bae4caa7c4ecca659aec342472fe49b3c0b2131
SHA256a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212
SHA512d3527aa4e7d4a8fbd0565ea8c0d26dc7e9ff0f294efa5260b9e964e5943782eb697b964cb684ad9008a717b93cfd120ec1337acb0ecbefef0931313f7b88e881
-
Filesize
536B
MD50be8b43a51c6659937b1eb93ca092a21
SHA18f6c87abb9a718db4a38f94e9aa9b4410aea90fe
SHA2561b5113d69b7555ccc1c60eb2ff4aeaa5868d470eed34c2f74fc7acb40a512be5
SHA51285a94293acb44f1d8a13b145874e5651f91b92d32e5e37bd29bc0e91e6b482246632b026f2e4cd21dc31f59237f6d292f69b2fa8eaa526491fe459a91fbd9263
-
Filesize
4KB
MD546cf944f117639380152758e44538b78
SHA130dbaa2f02a1924ac037dcb02a22fe7a173411e2
SHA256b958124547104fa5b0708aa39beba002be41ca0d88c7831ed891129cee0f46d5
SHA512b0a206edabb9c12666911235e78dcf5fc797c26fbc273de669d3690626d54ed44f3798128876aea0a64a1274bc1df00b4ca194a517ced3e607c8cfe8b0835e0b