Analysis
-
max time kernel
148s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 21:07
General
-
Target
d39cbfca5b4af90e9557d6349d2a68da_JaffaCakes118.exe
-
Size
669KB
-
MD5
d39cbfca5b4af90e9557d6349d2a68da
-
SHA1
9322449f3647b82c920e30bbf95f8ce25f875c7a
-
SHA256
212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887
-
SHA512
0aea822b94e81d1849d1e9713e019784a474885bfbfa6e88c066098cf2cf145706c33a5fcd00a616530a3414492747bdf68ea953433dfa7780bf0edf6b3f9ee7
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DrKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWGKrKe
Malware Config
Extracted
\Device\HarddiskVolume1\HOW_TO_RECOVER_DATA.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
Medusalocker family
-
UAC bypass 3 TTPs 2 IoCs
-
Renames multiple (159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d39cbfca5b4af90e9557d6349d2a68da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d39cbfca5b4af90e9557d6349d2a68da_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD5d39cbfca5b4af90e9557d6349d2a68da
SHA19322449f3647b82c920e30bbf95f8ce25f875c7a
SHA256212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887
SHA5120aea822b94e81d1849d1e9713e019784a474885bfbfa6e88c066098cf2cf145706c33a5fcd00a616530a3414492747bdf68ea953433dfa7780bf0edf6b3f9ee7
-
Filesize
536B
MD5f573a866369f3debdf761b619d0fd1b1
SHA1f3645bf5990e41b59884de9ce528678da7864af5
SHA25607381a54d4cb187e0ab4d0288ba5e09e866c9eac81dae68dd1bba84a1d31cec0
SHA51234fa9b8e0c0242c5fddfd1b275d8fab28a88447d2a644cd35126b088b801fe24d3a15aee6322eda7ddfe0a067fb97940374471625e4af904d16362cc33a20e54
-
Filesize
4KB
MD56ca969aedb057c2569ff99a94ca947fb
SHA1b78894f1a903e48245675f0aa68c7395379e6d83
SHA256b6ab77e350f727a1da318fea8c59e3098c70fe63df82a8f2ecaf891d06ba95c5
SHA512860bcb7f5be77e4f040be7d1f635a6052776b6f904820b0aaa27f3317982a0e51226a11de99e1ee65e8ceeaae613eefe9b01ac71632ffebae080c78579338acd