Analysis
-
max time kernel
127s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
14-12-2024 19:37
General
-
Target
f05df52a73ea28f25d0a85f927f2444a_JaffaCakes118.exe
-
Size
678KB
-
MD5
f05df52a73ea28f25d0a85f927f2444a
-
SHA1
a5c00571f42bad2f17db4d4032b07318abc6f7f1
-
SHA256
1e2335fef46f7320069623fff6702acb41c2877aff5fec83d94a561af37c3c7a
-
SHA512
0b2a3a0bde6fcc23565ccdb1df49727930ad53345f91a3450455d0e8fb431a59af74a169d8c6ae2195afc340d7fde42969638f5d4de5501d1f75737be625e0b2
-
SSDEEP
12288:cPJ4U0TYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuYJVoM7:JzTYVQ2qZ7aSgLwuVfstRJLHYM
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\Recovery_Instructions.html
http://gvlay6u4g53rxdi5.onion/21-9wA3X0WIwPScg5iK8DAPnytF2A39PT2k-0w5OBYWs0aAcsVXAdx0kyEMFKtNJgsma
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
Medusalocker family
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f05df52a73ea28f25d0a85f927f2444a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f05df52a73ea28f25d0a85f927f2444a_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {94D4D5DD-1BB6-4205-98C9-AD9B51D8202F} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
678KB
MD5f05df52a73ea28f25d0a85f927f2444a
SHA1a5c00571f42bad2f17db4d4032b07318abc6f7f1
SHA2561e2335fef46f7320069623fff6702acb41c2877aff5fec83d94a561af37c3c7a
SHA5120b2a3a0bde6fcc23565ccdb1df49727930ad53345f91a3450455d0e8fb431a59af74a169d8c6ae2195afc340d7fde42969638f5d4de5501d1f75737be625e0b2
-
Filesize
16KB
MD591934833d10226494b3a5a9121ab4f03
SHA1db0398ac6329b11a0697a27aea74477fede26751
SHA25602b166f61e7492cf34fab3f880058394c927b9e1450da56d7a9badf1d68c2c27
SHA5120d2a2834412a9b2657fc3a4e907ebe159477b302e52633210873c2848a6559311dc6efbab821248c79c7fea5e4742cf8af647b8b16ff918bbe3ddf565b01e88d
-
Filesize
536B
MD538e9bc2b39a538bd212d4ebe204c16dc
SHA1f19e27be481a93842586409c9db4c2f9c9ce7861
SHA25659bff1277f14f9bd9e1234b83d7878b06124cf9c60b4cfaf388b0e0d51e6d03a
SHA512783034b17c76202d53665f66bc7dba086a5047fd90fa5fa13d50927d10a41e4f0aa1ba495bd250aaaa1ff7273e900ae82b33baa3c3b25dfc872f0bedf4acbcc1
-
Filesize
5KB
MD5d3618f11c070027dd9566fce9b28d692
SHA1cb64fc9a06ef38ea2be3fc729fd2915f785cc4ba
SHA256fa63463fa76d666e09f9ab0e64943a2699727c53086a7277fe3fe6f7bb70d925
SHA51244d88329fccd27e62d06defa2b4c7dd5de8a811fbe9e60c473d74262e33461f9ea4d8793ec251a97597814815bcbbc369e0a3897c581e24a6d5f08c1d7045c26