Analysis
-
max time kernel
126s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-10-2024 04:35
General
-
Target
45de70c85ece8763c685808eea085df4_JaffaCakes118.exe
-
Size
669KB
-
MD5
45de70c85ece8763c685808eea085df4
-
SHA1
c9dd5313a661fd17b154ccb17a36e8399fc933a5
-
SHA256
d595339cbbf415eca195eb3a0d9a8b6c9ff82a0cf36e4e867f5cef24503bb532
-
SHA512
03a1d922711db1afc0a512151371c9a97a7478578c11591109537b1427aeac8b3ac44aa52c83439afe56e20134fd888bcaee1632f6046ce8edf0d99622fb362d
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DNKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWgKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (305) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\45de70c85ece8763c685808eea085df4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45de70c85ece8763c685808eea085df4_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {551043A9-6AE0-44D1-8AD5-6F36D9458506} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD545de70c85ece8763c685808eea085df4
SHA1c9dd5313a661fd17b154ccb17a36e8399fc933a5
SHA256d595339cbbf415eca195eb3a0d9a8b6c9ff82a0cf36e4e867f5cef24503bb532
SHA51203a1d922711db1afc0a512151371c9a97a7478578c11591109537b1427aeac8b3ac44aa52c83439afe56e20134fd888bcaee1632f6046ce8edf0d99622fb362d
-
Filesize
16KB
MD5c2fbad723d3bbd36df97b4514ccc165f
SHA11f693214523e188993c6a5eb3e1eff2316a20c3a
SHA2560f1c0206996c6df42d03c13b3ae8ffa32a102f2b8b1ffe58002939637fb59ee7
SHA512670de16a0c504aa4680078f58a6c6720dafcf8b35bcf62dcea50225a9cd4ad9a8510aed3a587142609b4b9244f1616ca1043c26118d38a6be98e37a180d4346b
-
Filesize
536B
MD5f167b10291ba388056a3f5e12f2dc0d6
SHA14957d639abb36b345b7482836c803fdc7f240d42
SHA2564364d89f2e3465b4746f64cbc2b9e5bbf3d3c04ca096b2571c3a0c1cfa0baa71
SHA5128f538613ee76893c7b0de6a65ac82b0d7d8f0c51f695c3dfd6ad2974990e18a22fe0246a14f2e25990e063abf8e5ff50d6463e62d5ed234d49a7396d237becb3
-
Filesize
5KB
MD559c286cb9cc70b51ad6510056c5811b2
SHA13f408b9b45098b7fc7ab10ec13c65647628c00d5
SHA25651ba8008f8518ee6e2eaabaf70c8174ee17963c33467eb67defe44559a0275b5
SHA51221b5f84becb401d0f8c6ca0226d9f54524c059d8d888a934ff84708aba8a039d5f8f81808c6fa3afcce4201fdc58fceb508e4669188834a870916fed247d5137