Analysis
-
max time kernel
127s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-10-2024 07:16
General
-
Target
6da9c76a6e319c17f1d39e0ae2eaf2af_JaffaCakes118.exe
-
Size
669KB
-
MD5
6da9c76a6e319c17f1d39e0ae2eaf2af
-
SHA1
d8743d22c816de1b1807a64d2bdde6baea838cd0
-
SHA256
461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078
-
SHA512
70c3e123f887556ac42bb58d730b59d8d2df1cca4d3e895f79fb6cfa5c1a63a64d46bc6fdc23c711be7b966aaf80d2fb7e83f52bdf4c096cbc946f5a6c976db0
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DnKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWmKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (297) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6da9c76a6e319c17f1d39e0ae2eaf2af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6da9c76a6e319c17f1d39e0ae2eaf2af_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {D23D9030-09FE-4342-B8CD-0A18FE17AAD5} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD56da9c76a6e319c17f1d39e0ae2eaf2af
SHA1d8743d22c816de1b1807a64d2bdde6baea838cd0
SHA256461f8a55ea2eecfcc26562326af4b56fbaf8e4957a4a6e0b75bec8ee90ace078
SHA51270c3e123f887556ac42bb58d730b59d8d2df1cca4d3e895f79fb6cfa5c1a63a64d46bc6fdc23c711be7b966aaf80d2fb7e83f52bdf4c096cbc946f5a6c976db0
-
Filesize
16KB
MD58b35dd1d107788be39288cea7d64da5d
SHA10c8d37d770736de5156401bc13fc88d833cf6254
SHA25664c2d279b52a70f094a357ce86ec6a5d51c5e6be0756b76b60d8647ab0dc3456
SHA512a060a358783e92609d85072bc22b0b700848b43c7fde591e8e9b61f99cf79d9606918106e0f760644061946d1546d083140b95dab30531e1f75649a13b13311e
-
Filesize
536B
MD51d3142e9f412af533b720a3053fd6e4f
SHA189b0c36f58185945489b3911e6c8fe65339c120e
SHA256052370984a23808c750e07130e6b94e3afc1afc4ff4470115c3369838e4fa7be
SHA512da2419704a26f9234b6ed029db048026b60dd28cb0ba1377d84c7456b90b9def20e80c9b48e63afe72295a40a557333847fe46019d01231ed7d36b025697b297
-
Filesize
5KB
MD5a88e8752ae7b731b96651749d7d4a97d
SHA15e76a31b17f3367ffc2e78a4a65281734ef7bd32
SHA256d3cf4a15783db24cc0e7e9428323962fbb829e61f91248c11d6a57690892b75b
SHA51228a940602d5e6d81cb22e08e7c34b04b927d175acc0ddb246fdc9e8f86d4d03df1c7513b158ee3a7f65207d19d1c9c2ca8bc330b8bc43dd0e0110674c02cff4f