Analysis
-
max time kernel
127s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 19:37
General
-
Target
f05df52a73ea28f25d0a85f927f2444a_JaffaCakes118.exe
-
Size
678KB
-
MD5
f05df52a73ea28f25d0a85f927f2444a
-
SHA1
a5c00571f42bad2f17db4d4032b07318abc6f7f1
-
SHA256
1e2335fef46f7320069623fff6702acb41c2877aff5fec83d94a561af37c3c7a
-
SHA512
0b2a3a0bde6fcc23565ccdb1df49727930ad53345f91a3450455d0e8fb431a59af74a169d8c6ae2195afc340d7fde42969638f5d4de5501d1f75737be625e0b2
-
SSDEEP
12288:cPJ4U0TYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuYJVoM7:JzTYVQ2qZ7aSgLwuVfstRJLHYM
Malware Config
Extracted
\Device\HarddiskVolume1\Recovery_Instructions.html
http://gvlay6u4g53rxdi5.onion/21-9wA3X0WIwPScg5iK8DAPnytF2A39PT2k-ANHTGfPurEsmJ5bU0w2LEPbE9axPx4Cj
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
-
Medusalocker family
-
UAC bypass 3 TTPs 2 IoCs
-
Renames multiple (184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f05df52a73ea28f25d0a85f927f2444a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f05df52a73ea28f25d0a85f927f2444a_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
678KB
MD5f05df52a73ea28f25d0a85f927f2444a
SHA1a5c00571f42bad2f17db4d4032b07318abc6f7f1
SHA2561e2335fef46f7320069623fff6702acb41c2877aff5fec83d94a561af37c3c7a
SHA5120b2a3a0bde6fcc23565ccdb1df49727930ad53345f91a3450455d0e8fb431a59af74a169d8c6ae2195afc340d7fde42969638f5d4de5501d1f75737be625e0b2
-
Filesize
536B
MD55f5a2e0e430639bc8c198e6a4c9b1f06
SHA108ac73cf530e33bb24e62659755c2309588e38ee
SHA25609eb2794f8c4f16184852a6a26f9175de4a24f7e1241873866055d10c0f2c872
SHA51219312a1176856603054d2a4f2798f2d74a17e7e2aab2402ea5d2e87848347c8a254c5406c55d7e1b7705838c46a3fc6ac0cf93c42c01d4e819fdb9dfbf78bcdd
-
Filesize
5KB
MD5061cf669639c53baa5b461ef1e0ec9ee
SHA171e724de39efc84eceba9c709686e89e10eaa318
SHA25628e0ea7fd2bdd2c9eb4a2d66ec1f435c31cb9900d8f08d5d45572bef7d0b8e62
SHA512d626f91f66c47cfe2f97b697103c93dc6b8d5c5c3b680588b8bce3bd371bd28c2f5906f5b12ad4882237eda26e3d256767fcae4f6f70738a978b2b79a6ca8230