Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-10-2024 10:46
General
-
Target
2120cf93b6be39884f951ee2a31c5999_JaffaCakes118.exe
-
Size
669KB
-
MD5
2120cf93b6be39884f951ee2a31c5999
-
SHA1
317b695da0ece90979f0400c2c7800e50bec8bb9
-
SHA256
c5bef2a489740192a0b2c34cdc2fd954d0b8d5fabcbe0ecb8b78f9301e5a30a6
-
SHA512
3038b27dcc263675a642f77d9dbaaff921c3a56f160051df44619dbafcd5d108db1c6caeacb70179c511e284035d329f29c34dd19500d2bd4006d2f86ee1dc33
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DKKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWjKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Renames multiple (214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD52120cf93b6be39884f951ee2a31c5999
SHA1317b695da0ece90979f0400c2c7800e50bec8bb9
SHA256c5bef2a489740192a0b2c34cdc2fd954d0b8d5fabcbe0ecb8b78f9301e5a30a6
SHA5123038b27dcc263675a642f77d9dbaaff921c3a56f160051df44619dbafcd5d108db1c6caeacb70179c511e284035d329f29c34dd19500d2bd4006d2f86ee1dc33
-
Filesize
536B
MD5a358dcc04726cb9e51b5026c20474a0a
SHA169f521ce60236c2a0627ae43396a4ed9ff9596b3
SHA256185626480eec9f5384be8973e560878c09bd5618c5ffd4324a7d59ed9d840f18
SHA512750540064be23df27a98a46cef5a91fe9c7a34b34faccc8d05a6b19cae84339d8c1409c48d118ebeec30fe94fea29f687b3923e64092f0e79873c137125338ed
-
Filesize
5KB
MD5050c4c6b1d321042cead0665b1af9327
SHA1df12786ab3acf51ccbb6dac0f441bb8597d09ac5
SHA256a3732f3bc353d617b53e7620ed1aa7c498f9dcfd35bb791ae061d0d6bdb2fb2b
SHA5127fc273d35d298bb1dfb8839b63e33a9b2b05ae9f1a225eb7a7a3aa7fa30e57cf16fc3daf82749b28de643ae14f5dbbdf299dffed3183bbb19dd586b3c02a754e