Overview

overview

10

Static

static

10

2024-09-20...er.exe

windows7-x64

10

2024-09-20...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    126s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 18:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-20_ed858a19f5881d5b4c1d291fc3c50bde_cobalt-strike_medusa-locker.exe

  • Size

    669KB

  • MD5

    ed858a19f5881d5b4c1d291fc3c50bde

  • SHA1

    2becf1d3b743ecf638568065aeb631653f69d003

  • SHA256

    f6e687b576ad52361379864e8065da6fb698df4ec6e0a1f664670229717eb230

  • SHA512

    7c6c83e63ff207b4957b58f076304724007b0b886388f07142264f516dfcda1d12f73ec8e71bba0cce6ed6d2a31d055c61f5df4bb95442bef88e9c16f1c57906

  • SSDEEP

    12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DOKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWnKrKe

Score
10/10
medusalockerdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_BACK_FILES.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">D0FCF90FD1B1921DF317E3130C754D50EA2A6AD32D265414E0C3685036E52B3068C333AA36C6D032C51444DF98651C793E2DE84C89F1EF6A5118E03FB0573585<br>8DA44C53790E95C19209087B6632EC5B3C8B340FD79C56D9F306547FE14CD7DDCDBDF79C6E6926DE827DBB816CF4C4B88682E2D1990E4734D059D4567029<br>5059716626804D3AA251823F3D8685F8C9857E7968362C54671E6FBD2C24C27C32042A97029F81CB79728681CA0F5B39C3F1A7CB1AD83550BB5094F7CB00<br>3571BCF7AB1ECFE615BFC300A73DBFF460D7686A7ADC7E3FF52CEB9853263E99FE6D926ABFDE2824B9F39E24271CE402B89C601BB6F1EDE71F30B96A276E<br>D41DA9D06570477F9B0DF6BF7716F4C6612BDBE0B24F6BE092B7FBE6E1A29B113F9AB30DF5B6473861CF3FA3A62F735CCE4B1C4D0A91E89B3BFBEE88B6C5<br>BACAB30745923CDEC010C466CD33374214D4F461E9E102C51E787EDABC91E1D9B464E0B766AEE4B7E084EBD2415912C8C72D1DC1A5D58BB5352322A7629C<br>3D69BDBF583698B12D5D60FF516278B01E0A095CB88643C2BB7E6B7DB05C9016F785746E389E8E5E29BB0CD815E707C3A38E3B0B76E8BABE1582BB300F77<br>FFF68D6B87056BAAFA55FA757C5F8230DB4D87232DFA6FD9F108BD10CA784BCE1B88EF5804DE9C68AAE595581D3CFB8C7176D2CC3636D2A8065FB044A494<br>5154A32D9B2763B1061A1E07956A</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <hr> <b>email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> <p>* <a href<a href<b> </div> </div> </div> <!--tab--> <b> <b> <b> <span style="font-size: 22px"></span> </b><br><br> </b><br> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 1 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (327) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-20_ed858a19f5881d5b4c1d291fc3c50bde_cobalt-strike_medusa-locker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-20_ed858a19f5881d5b4c1d291fc3c50bde_cobalt-strike_medusa-locker.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3052
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Interacts with shadow copies
      PID:2816
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2752
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Interacts with shadow copies
      PID:2652
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      • Interacts with shadow copies
      PID:2496
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2428
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2756
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0612A162-9B28-40AB-9BC3-5C9AA3986850} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Roaming\svhost.exe
      C:\Users\Admin\AppData\Roaming\svhost.exe
      2⤵
      • Executes dropped EXE
      PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    669KB

    MD5

    ed858a19f5881d5b4c1d291fc3c50bde

    SHA1

    2becf1d3b743ecf638568065aeb631653f69d003

    SHA256

    f6e687b576ad52361379864e8065da6fb698df4ec6e0a1f664670229717eb230

    SHA512

    7c6c83e63ff207b4957b58f076304724007b0b886388f07142264f516dfcda1d12f73ec8e71bba0cce6ed6d2a31d055c61f5df4bb95442bef88e9c16f1c57906

    Download Submit

  • C:\Users\Admin\Documents\NewInstall.xlsx
    Filesize

    16KB

    MD5

    84a5f4578bd61559ac4392e42505ff70

    SHA1

    3a6a5bf514e9f436ac39f3d8c3c545ee3eff3128

    SHA256

    b4975b502dbe2f70a048ed72ce034f67641822acb03e28de50df16286590f470

    SHA512

    93f52ee97bc5fd37cd3a5d36088e0c611c98b997ec73fb4b8ad4db98e938eebba177789a61c9968a617e1f842d8bd680bf6cb52aaf033ce408b440cb5f61809f

    Download Submit

  • C:\Users\Default\NTUSER.DAT.LOG2
    Filesize

    536B

    MD5

    2189ba697bfdd37635f20739f5d64fc2

    SHA1

    088f587095af8a811e8d57b0e052290caaf53f63

    SHA256

    d6a14465ba357d308399cfcfd467da7cbc7e95f71b4dabaff38134edb2a4fc03

    SHA512

    09bd92f9abf7be88dce37643bbb8384b827fad9966b874839dbbbfaeb0d0507f61e42498bf6485403a17266ccc2a76ebcddeb187973d0435a15a2bfce53ae5a2

    Download Submit

  • \Device\HarddiskVolume1\Boot\HOW_TO_BACK_FILES.html
    Filesize

    4KB

    MD5

    19665b6771ab355649b3926e56a27667

    SHA1

    c058ed7a9cf9d04d4f01a3a41b3378712a7c7c65

    SHA256

    40edf843c14296de0195d8cbfb5ca8dbe633470bd6b136eaf52635ee1a7ab80e

    SHA512

    4689baf3de9f301d4605c3e351640432066d954ae62a318c633322f24eab427e9d001b5ea4d69a4e02e8f873fb9afa020326fa0776bfa910b417dbd24698b9d5

    Download Submit