Overview

overview

10

Static

static

10

b2493a5801...49.exe

windows7-x64

10

b2493a5801...49.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2025, 12:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe

  • Size

    719KB

  • MD5

    8474039d83805eb7b447325c3a8d1ebb

  • SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

  • SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

  • SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

  • SSDEEP

    12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6

Score
10/10
medusalockerneshtadefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">5EBBEF47970666C5D159BE3675221010E301DE6983EF58AE997F441E35207ABBFD386B06A8AF000CA9000C53C54EAE1C2A12761F4EF5264DD00B5B7DD70EAF77<br>6B506D0730539805C7F4F1414FAD8A3E1D761AA867D1CED501442895B5EB1DAE4C04BA168D6E973F89769E00081EF211F8FBB0D37169CFC97125EB5B335A<br>E52AD743A993BBF0CE355F262A29E507307AE9FB25E298DBD39C992B94103BA548495D415027FF0D009A8B1521E56721EF53C13EFF255D9CF078778C3737<br>C31AC35C2E98145C7B54C3D2FD74EFD3D78EE9781276F1B338CEFD8DC62869660F2A87831863E72D6C9A4B6527FB1997B2CB1649B2C54E3C0B34DA0C2BB6<br>7A4AF2A09C20E230452380AA3D9534EEEEC0F0BA2E26E12286B6972305602D023444108F90DA3BBA7902B611EFA12272293C385244BFEEF4FFA6D591CFA8<br>3767C2A091385036B09ADF52897AB49E5B485A5248F38A2BF13747B7C7A10E79536405CEC14E37B74C07C12C7E3ED8B9A980C7B7AC800004744F52AFF8C7<br>96BEF53D9888706E464A6F2C52EF345646B74CDFB0D8102E18C7A888C1A53149EF790933B37B00AFB57400CB8E18F2EA9A5FD48794788324265351171AA4<br>8FA72E3677B366598BE7E182C07C0A2C80423A8ED44599B1ECD5FF32A4033E36694DF1CE1B92DA45FA018D4A65A23C4C77842BF45A8630491F01243EB235<br>2A949A7F0EC6C328A059B3CE6E52</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-rDHRYHYXycX1u5UuV47YxTOMH17Bx7Sc</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • Detect Neshta payload 4 IoCs
  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 1 IoCs
  • Medusalocker family
    medusalocker
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (223) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    "C:\Users\Admin\AppData\Local\Temp\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2764
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:2176
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2524
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:3004
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3020
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Interacts with shadow copies
        PID:1132
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2172
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2552
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {7D64C1CE-09EA-4DFB-A980-FC668EDC0840} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Users\Admin\AppData\Roaming\svhost.exe
      C:\Users\Admin\AppData\Roaming\svhost.exe
      2⤵
      • Executes dropped EXE
      PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
    Filesize

    547KB

    MD5

    cf6c595d3e5e9667667af096762fd9c4

    SHA1

    9bb44da8d7f6457099cb56e4f7d1026963dce7ce

    SHA256

    593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

    SHA512

    ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
    Filesize

    4KB

    MD5

    4e1c0894eeb7c3dbea8865d26785d37c

    SHA1

    4f0525f88a35e2918b9018505750fd070de1ce97

    SHA256

    0a47385d1a080368aeaa2418ad9ac70d862303ffcdab62e2f083f766688c3c1d

    SHA512

    2265c425e211985409d7c54b6869226eea7af6b28a43f4cbaeaa0b4cb75888495333f4443f7fdba701747d9a4933ed30f9014b998e7b9dfc2d62e2606890722e

    Download Submit

  • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
    Filesize

    859KB

    MD5

    02ee6a3424782531461fb2f10713d3c1

    SHA1

    b581a2c365d93ebb629e8363fd9f69afc673123f

    SHA256

    ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

    SHA512

    6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

    Download Submit

  • C:\Users\Admin\Desktop\WaitDeny.xlsx
    Filesize

    16KB

    MD5

    389ca88e9cfe221776ffd6eb40c77eb6

    SHA1

    d68de9a67bda39aba64c10b6b852a23b5bca5c4e

    SHA256

    c40753d757bad60d0e9917b83cbe0b1f9b1b093a86cd9c28c7ac40b924c809fa

    SHA512

    6a98322da0e30ca4e53b8e364d8a9ad98906bdc6c302ef2be75756da77c77214084474c40b7dda3cdf6c7ef3a7049221cce411d834397fbafd49fedd3be083c2

    Download Submit

  • C:\Users\Default\NTUSER.DAT.LOG2
    Filesize

    536B

    MD5

    e2152f54bb95a5bbe029745f099b8d18

    SHA1

    4b42573962ab24a0a4a98762b76f6a11f38d5aa7

    SHA256

    1e393aed64ee5ce997e271ba1fcd3e5528594422803cf26acb412565d0f6957f

    SHA512

    b848904ac10ca209556e421d6f88ada34a5d96fad3d4eda65a39c6328cb78a435488201921c2ece102e29da251ac45edc589fc288c61c8ac10d42d3227318c54

    Download Submit

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

    Download Submit

  • \Users\Admin\AppData\Local\Temp\3582-490\b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe
    Filesize

    678KB

    MD5

    5aa0a571567f8437556e9b00ae5a3532

    SHA1

    45377cb152832c9112db7909219fa87a6e760aae

    SHA256

    73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432

    SHA512

    d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec

    Download Submit

  • memory/2668-778-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/2668-780-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download