Analysis
-
max time kernel
127s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
08-10-2024 10:46
General
-
Target
2120cf93b6be39884f951ee2a31c5999_JaffaCakes118.exe
-
Size
669KB
-
MD5
2120cf93b6be39884f951ee2a31c5999
-
SHA1
317b695da0ece90979f0400c2c7800e50bec8bb9
-
SHA256
c5bef2a489740192a0b2c34cdc2fd954d0b8d5fabcbe0ecb8b78f9301e5a30a6
-
SHA512
3038b27dcc263675a642f77d9dbaaff921c3a56f160051df44619dbafcd5d108db1c6caeacb70179c511e284035d329f29c34dd19500d2bd4006d2f86ee1dc33
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DKKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWjKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (328) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {7F3A0A51-ADEB-4D07-84B5-8F7EA4AA0B84} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD52120cf93b6be39884f951ee2a31c5999
SHA1317b695da0ece90979f0400c2c7800e50bec8bb9
SHA256c5bef2a489740192a0b2c34cdc2fd954d0b8d5fabcbe0ecb8b78f9301e5a30a6
SHA5123038b27dcc263675a642f77d9dbaaff921c3a56f160051df44619dbafcd5d108db1c6caeacb70179c511e284035d329f29c34dd19500d2bd4006d2f86ee1dc33
-
Filesize
24KB
MD5a58210cc0d41c25d3624637b4cdba8ee
SHA1b2abea765af8703a939db88bf1d85deba4473c79
SHA256e1580646589facad67e04a833478c4887787fd58b10c467568f53b62d1b7f50d
SHA512d012924c0fa9ce170b1c4020e4686bf4272f9ef6320f81fc0ff1622f96b6f83e8b79b08e81b05d2bfc743f476746dd0f4b46e43ef25c4b8449ea810e06b3275a
-
Filesize
536B
MD51b2ff29b402dcf0f297521b02e7d7085
SHA12bd731f8dd0bdbbf7af936fdb8b25aaf4b937c7f
SHA256f548f16e4a9ccb78d4b37d1e5dd163771fd76b9a2ad0af124bcbca5e4050dc19
SHA512e8d6bd9b017bb9fa54237ff2c557f0a90801cd04ffdb0a087c2eeb99792b8f2127d77a0b2814f531ec69482f06b2f341c5aa8ed647d867f134be382902b5c859
-
Filesize
5KB
MD5e9a0c60d5620d787096d181f828fa3e9
SHA1bc7adfb616dcafaf40de6ffaea5e6a19095a5aa7
SHA2569046158c667b20167e3ae8a7c173e0206a7ad0f00a42fa7ddb45a240172360b6
SHA512948155bda3c247a30b150e0f428c06c76c164ada7627263fddb23f3d1850418107716efa5043db30fce5a10b6b469fea01fd1e80e9fa8b48d44ae3eaf23a2303