Overview

overview

10

Static

static

10

b2493a5801...49.exe

windows7-x64

10

b2493a5801...49.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 22:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
  • Size 719KB
  • Sample240808-17l88avdkh
  • SHA256 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
medusalockerneshtadiscoveryevasionpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Recovery\WindowsRE\Recovery_Instructions.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">A5E04A812B2BEA929D97436490F02CD1BD877A241612DB3C2B76CC46F9A994F0B30C67CEB8B00996C0F017133F3EB3B474B2A3989627DDD01F1A32147D4BD971<br>6E7D2C6B8D60A7D905B93543AAC5160AEC1564EDBA9F0DBE7A04CA02B607AC11024E85F45D93EF057D3FBD057E656320F6AF6B3BC2EA16A7011CE3ACFFA6<br>32A4B4004FC9076CE6378DADD6A6E72F705AA037A63A94BAA51EF97029F3D7EBFF8C939B2F02598465C0A3322896BF263CF3D95E64A5B059D2748155006E<br>EF8966CDC3EEE54C72221188301BB4E4EB7DC6ECAC6343D29D5BC0E8E643ED3F2A345608BA5479086D6DA7050E19AD9EB16A5C8F0AFB65010381ED92CA86<br>4AC7979A854AF6D17A780BCBE27F3A6BED78AE91FD29EF093685ED3231DDDB98A5022E2D6C200BC74FCA864475DCE2FB79C52C26D52AEB7A861D7EABB792<br>59928C7499799A19AA81D2B80D88C5755460DAAC4FF583BD242CF24FE9A948A069BA83C7A5569670F61F181D01B43E8B5D3804E447EF67C7DA724CC499F7<br>43FAEDC8407413518DE8519EB5A42ED4E2756480B76590E1F40D51087A7FD4CC7077586F352F77C685B92F39A4B78E2B790A8900E34B6E732F311CE004A8<br>D2942AD9513EB741E267D96FF52E4AEEA223EDD2F5263F7245F643419CC47A71B65BBE7DA75078852F98AC25CB74251896141F8F6190965965713855B084<br>6B877150317B7DE2FB01992C4B4E</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-iP0G94Sc3mlI2LKSIMgNLcenKAear6ny</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • Detect Neshta payload 9 IoCs
  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 2 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Renames multiple (140) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    "C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3368
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2536
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3540
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3608
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3980,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
    1⤵
      PID:5064
    • C:\Users\Admin\AppData\Roaming\svhost.exe
      C:\Users\Admin\AppData\Roaming\svhost.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
          C:\Users\Admin\AppData\Local\Temp\3582-490\svhost.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4532

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Modify Registry

          3
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AcroRd32.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
          • Size 2.4MB
          • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Recovery_Instructions.html
          • Path C:\Recovery\WindowsRE\Recovery_Instructions.html
          • Size 4KB
          • SHA256 7ec662a5dbf3fdabaf1d30db14c683c7b0bb43d3b15043669902580470731063
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
          • Size 678KB
          • SHA256 73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tmp5023.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
          • Size 8B
          • SHA256 1320f495082fdb1325d1170ae344eb6d84057efa9684c6c2af57675ce3276be2
          • MD5 SHA1 SHA512
          Submit Download

          svhost.exe
          • Path C:\Users\Admin\AppData\Roaming\svhost.exe
          • Size 719KB
          • SHA256 b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ntuser.dat.LOG2
          • Path C:\Users\Default\ntuser.dat.LOG2
          • Size 536B
          • SHA256 739a09fd8993d2141577604aa14d094b451b765294ec1045d0293970f0b2f2dd
          • MD5 SHA1 SHA512
          Submit Download

          svchost.com
          • Path C:\Windows\svchost.com
          • Size 40KB
          • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2984-569-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4308-571-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4520-549-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4520-553-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4520-551-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4520-550-0x0000000000400000-0x000000000041B000-memory.dmp
          Download