medusalocker | 465ab4311a7db9f0bc10921cf6a0da7a746c4023dd78fdcec1c253eee69e5b9d

Analysis

max time kernel
166s
max time network
131s
platform
windows7_x64
resource
win7-en-20211208
submitted
30/01/2022, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

666KB
MD5

3f9c6aaa326c9df1efd1d26c1481b049
SHA1

eaf4f5287a2c8a71aebac36aef6dd78c0a58281e
SHA256

465ab4311a7db9f0bc10921cf6a0da7a746c4023dd78fdcec1c253eee69e5b9d
SHA512

6a38af9ade3c9111f6aaf13ec1d2879d71bbc40c7a5916a585e0be56f4795919e22f5c3dd02cc270adfcde76a68495f5e5ae79c62bf7c31b8842f910b8493b82

Score

10^/10

medusalocker evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

\??\Z:\Boot\!_HOW_RECOVERY_FILES_!.HTML

Ransom Note

0<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, user-scalable=yes"> <title>Title</title> <style> /* http://meyerweb.com/eric/tools/css/reset/ v2.0 | 20110126 License: none (public domain) */ html, body, div, span, applet, object, iframe, h1, h2, h3, h4, h5, h6, p, blockquote, pre, a, abbr, acronym, address, big, cite, code, del, dfn, em, img, ins, kbd, q, s, samp, small, strike, strong, sub, sup, tt, var, b, u, i, center, dl, dt, dd, ol, ul, li, fieldset, form, label, legend, table, caption, tbody, tfoot, thead, tr, th, td, article, aside, canvas, details, embed, figure, figcaption, footer, header, hgroup, menu, nav, output, ruby, section, summary, time, mark, audio, video { margin: 0; padding: 0; border: 0; font-size: 100%; font: inherit; vertical-align: baseline; } /* HTML5 display-role reset for older browsers */ article, aside, details, figcaption, figure, footer, header, hgroup, menu, nav, section { display: block; } body { line-height: 1; } ol, ul { list-style: none; } blockquote, q { quotes: none; } blockquote:before, blockquote:after, q:before, q:after { content: ''; content: none; } table { border-collapse: collapse; border-spacing: 0; } body { background: #2b3d49; background-size: auto 100%; background-position: top center; background-repeat: no-repeat; font-family: Arial, Helvetica, sans-serif; } .all { overflow: hidden; padding: 54px 0; } .container { max-width: 1092px; margin: 0 auto; } .head { padding: 0 20px; display: -webkit-box; display: -ms-flexbox; display: flex; -webkit-box-align: center; -ms-flex-align: center; align-items: center; -webkit-box-pack: center; -ms-flex-pack: center; justify-content: center; margin-bottom: 35px; } .head-img { margin-right: 30px; } .head-text { color: #ffffff; font-family: Arial, Helvetica, sans-serif; font-size: 35px; font-weight: 500; border-bottom: 3px #fff solid; } .content { position: relative; color: #ffffff; padding: 0 20px; font-family: Arial, Helvetica, sans-serif; font-size: 14px; font-weight: 500; line-height: 21px; } .content a { color: #9676fd; font-style: italic; line-height: 30px; font-size: 18px; } .content b { color: #f25252; font-weight: 500; } .content c { color: #f25252; font-weight: 500; font-size: 20px;} .content d { font-weight: 500; font-size: 8px;} .content:after { content: ''; background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAjAAAAGhCAMAAABI/X4mAAAC+lBMVEUAAAAwDh8/GCkA6eHlc4tFxucA6eGJRUTihIQdx+GpXV4A6uENAjEA5uIA4OHJdXUA6eHckXzfmHoA5uEA5eEA5uEA6eIA6eHmkIHedYYA5uEOBmvCb3AA5+EA5+EA5+EA6OEC6OEA6OEA4uEKBWXbgX9Tct+eV1ZbHh5dc+Bec9t9Ozu3aGYlAwUA2eEC5eFXat0A5OFabt8A4uI1CgkB5uJTZ91NatvIyPsxBgRRZ93AwfgJpN48eN3PzfsMotzExPpRadsGkN5SZNwFr93Hx/knhN0NnNzKyfrRz/vW1PsAt+DQzfsAu98Az+AAv99mc+INk9p8iOl4gunMyvoAxOAAq98AoN4Bzt+Biuw4e9wGl94kCmwjCWsYitokCmwkCWx8h+ukrviRmfKmq/oCu9+ir/kkCWwUi94kCmzCwfg3IokkCmxINpZEMpXFw/kzHoRHNJbLyfqss/XIx/rPzfvNy/vS0PwiBmo2IIhTYtzV1Pw3E4IfBGZALpHAyv84J4xJK5IHAFULAFgAiLVLOZZYZ96xt/kAl704G4fX1/0VAF83GIQA6eJueuYaAWNJMZRLJ5C9xv/b2vxodeQAnsIAkbs9Ko4QAFt1gOnh4P0AmsC+vve3vf65wf8Ai7hjceN8huuzuvzd3f2Eje5cauDm5f5gbeEBea8AkLgAgLONlfGutPmWnfMyMY8AlL0AlLovPJSeo/YyG3xMO5wlDHBDP5qmq/qorfGFkdg2Dn4qEXQtFniJlNoAcao/SZ5EI42fpOian+QBaKejqOw5I4FsYbEqRphiVag6UqKOmN0xXaeVnOEmaKu5uveQjdUAo8N7dMAkT5yDfshAK4ZaS6BzarnEzv8dVp9TQ5lHNI2WldsYcq8XXaKJhc8Al79KatxNXNsArt8LYaQAqsapreoA0OC4uPAAnd6xs+4AxuDt7f8AvN4Aiq9DVtccLH0MRooA/O1I3O1n3u8AX5epo91X8fkBOZ1VV8M+Tbsw8PcfSLGG6fkAAEc5jB+NAAAAanRSTlMACRKRTAZ/HEwMJYQcHhQsjTNMM0AplYlMMVVHTEtmb59eef0yPxtMS0UwTDMq/sGG0VusOea0b0JL5xg6/ndRK539zWhb/SexlL5+2Z/mttmUbqXtz+HIkMbFr9CqenPr6LeB3O6Ujtz7glQwKAAAbipJREFUeNrs3d1qpDAUB/A/HHJAQkLAmICQGN0HKEPpY/rO23Wq0bbOzvV4fpeDdwZzvpKB+El5CyGeN5FXEOJZOdDUQognDcTOZQMhnpKImEmnBkI8oxvIsabJQ4intBNpjmHoIMQzVNLETDRKKCOeY0fnWFOUUEY8pmwNZaKEMuJ/1DA2uPMcNEeSUEY8kgt73DV9JM2BZVsS57KLYWhxZzK5yBaNdAvEiVw0O9pKve1QdAMjoYw4Yft7ftQ3uEuThXUlSygjftflJT/idYU0CoYjuVEGH8SDUm9I2FhHrIOWLrb4XZMiUQK8wUK1U4gcMoQ4Ult+VHpgoKRqt4BGoJVQRuypbSdqW2AMYWq3aLhkoA+9lGXEzsdcOqwysatd69YDngLLDKeobvM866074O5da4tVCuyCbEti94X59DFuoYxzrHcDeJ0mHWXBiM00Lxy2Um+IHKmGMiPJF0bsdO/zpzeslNek2YVxe0BOFYiDdJvnd0DH2i0gdhNWSvIkcTTMN6DMN1u7BWEATJL8SPyqHQGa57b+wFqhK7IbiSNlsCrz3MGsdbrGK3SRKFscmCxfnStTw2Bw529zC1O4xaoLmovHQTffEsR15bKNwqipg9FE2xKymVzwsPtSr/nzGSHLcZTrGpwm9lgZ0lwSVn569zA0dfWB+dMfmfu9rFzi/qhAMy4flU0zelgOdZrK3uav2rC4pCYtdTo31qne94QdBRMjlx5fbJwXbzL2e1FmPPaPVO9x0OQQKR1qw4siLYOLup96DOzPZzhLj530Ni8klLkqz6TZnZ96VGPCQf6Y/5G63tWo3VSvZnK9ffhgZaMsmCtS/f7U4xLKqKfb3LJgLmgoW37U1VGYh2yHu/4mmdLlZEe11Os5LAdnOzxiwrpxKTnrdjlDYF3nvG0fiZlib3HOOBkMv652CppjSfg+1atwxhBvNz5UXqoy16CSJk0joOrB2cgxnIcylmm78aEagtx3dhF2dKUH0tjslhC7kHCi6R0xk+sbVGMIMm51FZ3OQCq7U49ETOP/LvcNk8UmB7nv7DqaDkhulx91mZavTsIJP4Woo9n94EizXBLy6lSn8KUvep8ftS7/+21oz9vcQVusauVPJsdf2sTd1rVeX3itz/XO0WhOYx8y2NRDcIOEMi8sl/0Fd9/zo748vO65s783MeXfUV7X4PQu3fEcDi/cLEuotPjGmNMEKt4TKAllXlQf9qMwP1+4Z4quxTeevMKROYQyQUst+DWp7xeAm3zMmJvkfn5h2vCj1JsHW4vHUVLs13UfhXFu3L9wrQ3Uti/9XDD0I1IZi05qPydMWralF/WXvesJbaQK49EwCyEmDKRJIdI2ST1bpBQEYfEirOLRo6K3RSeHRajN0AmGNoeZdkIPpbG0QsCFkukhTVhyMC25BI03a1zXuFgvWRTMLm3Tbg+lB7/35s97M/njHifL+8HCFtJe8uO93/d9v+/3rPqIfOEx+LbDFiN8fWrXi2eUdAU9zfvpkBDoyqBIcTYteHnw9p0P3iadWyxlqC8cenKBCEiZUa3eSW+APmFsJs8wOMeDMHZijpmXBK++3+3u7Xzwrr0gjoSoijng50dk9cKMkvcHbDebPe9sAmSQjz309pLgtc9Sf/zT7e7szdveMuFDlCkqACV1JD5izE1OGFou8yGSKxP0+3n20NvLgE9TGyvrPy53uzfXMao+igBh5mI+wghv1NMHa28pQKhAOSPojRQfnDrQ52H30tjjbjKZ3FhJ/tq96V30EtYX7oevdo7KSIzH4oOaw5Ya5gYU6ZEp5KaixZF3xsMw5vgkibC+8rB3dXVxfecd80QIAmHoPdjQgMMh7iU2YAKSBx1FnKJ9wsgoMc2WsccZr3yc1LFa1XJX1193bxNxO/d/e7AzsUGPQ06FqEjxaIREQgSjKP4slptnM8nxxWtJE+n1s+McqN+LiBUspDNm9hY3rKROeMlQmt5XCVJuKvoDYeCOH/6kl3XyxhWvJy2kNtYvv9/r3lwsJHz2Pdi3osPHCaiTa2/1xr1UHnTI75xaR3IAdi2NKz7VuZIyKLP68PnN1cWFxRCfP4cxMcIGjF9Uclg0ofPH0Q+9UUPM6AIjzBjjbhKhmkzppEmtbmevQf32YvZIj6iH44a3eu0WzZDe+YvSvWB65SkQY4QZX+AiKXUkHibPDtMpXco8QZT58D067nnKw01PjHL1Bp27BODrtKDPwSNxzkpdZC92jSmgSMKE+UZ4UH92lkKUSW1sXP57fXO/+8GMqVQSs3GkZZ29fZohAY+j1Yv6NhNRjpqDTyY4D8c2a8cbr32OCfMgIwrF8rPGaTqNflyvFnvd7lpvbsq8VcJoCE3izPoQcDIg5Ae6Tc3P+MgcPDLDeSZibDow1ngd8yV5LyOK+3JWe3Z5ZNxLpz992QUpMx+mFhpJnBlBIDxiX2UiwgeoGhxiqiZyC+w2Gmd8iglTFQVR6cgHBaDMWVW/l1ZSv1xDvbTgD9rizOyJZYgTfcYHsq8yFfODN8JKeAgBYVCRHnJwLsEuqLHBXUyYw4wAjGkW5Xw2q9WRlMHTgst/rxBlpjlKuzpnkKH+l/1mboWJcxwIQ7l6gTAAr6MyZ9Gt4wND8wJhBFFSWllZy2qUlNmfRZSZo4wPMSdhSCeXGKgo5ziyTvFUpPgcSlD0BOmbLbgAIys2LRgLvPKZoXkFBEXKdPJyAUmZQ1PKHKN7qcd7rDMj7rh/eLyOEqcIMO3FJk/aTBObokMUeY+PTrcK5nJsWjAmeONzQhhFFARVqtSxlCmegRTGJfbZ0+ur3g3xcAb7bcBeu0UzGgOtQxjhg31+Otw3GEl4fPQ4gdNHVgvM+uB+GJOkexlBzJQkFWgjKc19LGUuUwB0L6Ubf1/fbG7eeXd4gEPES1s0ObL1aH7AeZH5eD9lr+ISeGTFXkdxP6wiSYA+TCMjKeheEtogZfLFalqfFqS3T5+hrszybW6oq/eWOeEeknc2NeFM+/XyPCYMmRYAmPHB7fiEFEli8TjbFiURKFMrNfK7+0L1VJcyKZAyP37Z3VmGaYEDQZ/ZySWEoQMcSAE1IlKcWCkAESZl3AxSJAFh8nl5v6lKApYyxew3UqUMUsboylR/3exuLhMpYxba/UfCC+adcVHHBRTVX0dhrl8XgyqSRKW4VciW5UYJ3Utw0jQzUqWgafXTVNrwcD5H99L77zgWZfvzGThTyhArzOhIcSJlGGHcjTd0F8w9XCSV6nI5W5AL7YyIflQFqSLnUYltdGVWt3/7oru3/NFtmjD8gAyQ6ASJjcFS5oUzEgMxRhhXgxRJAFXF9VFhqyMJioI4k2kcyGRaAJRJPVru3qelTCiiKxXnLgG1KsA7bL+jI8Un5lil5GIYRZKAgO8hqI8K5YYqZhQJMQakjFwukGnBxsrRXzvdNSJluFCCJD7YdgmCRMqQDwxFgFxcbAfbxSBFkmC2ehv5444kdYqGlFFa+NQxpwUgZR4/h3sJSxk6n2EySJ8waKw94bN9YPTWYwBMnizc1/0gRRJWLXp9tN9QaydPTCkjCScFfVpwlMKfXln97Z/uzhJIGeodNz/duAvrYVXx/ofehhMG/kIkweSLy0FPksRMu2LURyVBOpG1rY5qTAtKjTI2Ppymk7iRt5J6tNTdXLIlPvBBZ8Adsmj6KAphKcMN0zDoZuNZ8pDL8Qbmi14kIQNVW8CtXkWodY6RlBFK+NSRJKSGC7uX6VR6Q5cyD34GKbN0h0p8CDi2Hnl0wkxNkwAHVGLHoiOzjFginsth2u0ETJi6LO+3FAlfRHCoHDckpVGHaYGphrdODlPPLjc2koDtVSxllm4bZ0h/XlAggSyaMWj1EmM4echgaJZRhIVVuRh0kYQtmnm5WJEsKSOpDWtaAMaHrbpae3r+5HRdL7E3wMN5f4mU2E5wASCM1/TKEGP4VJSmjDPc18+zW8m9oIskUTmR5Wz2QGuUavhQESqi2pA1PC3AUqbZUtUn5+e5IowksZQ5/GWtuwZShnMOFsOURfMWlQoT8uNI8URoRCwjz0zi7oWtSBLVShFV0HK2LeBDRQXCHKNpQb1iGB9E6el57vz8MG16OH/4eWdv7fe3HJ6qhdlpshapT6191EMG3hEPvQWjXnbCuBakSMIQJbW1jyya5ggSSxk0Lch3Mor+iTrwZfZe+vQUGANYRV2ZtYue/W38ORISQh7Cph4yGBn3HGYaxrUgRZIBpSa0CzJ1qKgSPnW0rbYkYNRKW+fnpdpZ2fBwpiC86tsrSCKKeAjw1Hk+bGv1RhzpvwMixdld5HYYRZIo6FDNpks5CwaqToa0erWySRihBj29Sq1VNjyceFqAPJw9yvhgmKEmSd6Z3uol04JBkeIh9o6b20GKJIwSvockyZQyLVEyjOHasUUYQaypGam9m9U06ONhrKfqf19f/b4E0wJ7SMjCNG37hYrZZ4nbASdM2MvecXM5jCLJIIJQrGNXL5TR+rYJlNiKPmAqFU8kwYIC8liT81oFLqV0Wt8tyM52dxbJtCDI5wBOKQPzJs78QP9mfwhZyaeZ5HUx7EWSCAYqo9UrZU40kDJyoaSIiDOSCHMlAqyG5d1m7bB6dmR4OM8efdldWyRdmdB8DiMWsCU8BCwpw/WdMKig4iej7F5yK+giSbdoUk2XUv2grGVLakafWsM/GyRo7DUV8d6+lfiwcvTr/b2lxTtvexx5ZwkflfAQjBApQ0Cp4ckI075uBW230y2apD4SYX4EP5eAF7jV2wcRnTpKpljWiPHh4fOdncWv+qTMjMUIHO/snRwdKc4I41aQSRKGCKsCqD7KNzKqvjjb3gfC5LfwtKAfigiWvOwB9nAahjwwPuxtLn40P2WFOecACcoUFQQpMyDwl7O2t/3shHEt7tJFEmm6QCOmaYjdDPaBHxyAMVwYBFHslEniA5oWpB8t7m3ezMbCJO8MESYe95Edt8igSHGTY0GWLu9akCIJw2q6ZHc7KrBHr4dKeRkopLVU57VEjxOyaLcglTSNDzc9yOG0qLAwiT14JKs3Nj0oUtxSw+z5NreCFEk6RLM+kqGIbuv3kCg2EYXkoiIoQ6RMO7uLdguOzK7M6uMe7O+/6ecof3ecR67ekZHiPHvn2uUgRZIBxayPtsAJU5SNVi9enJUbitpqSn0Xk9nYA3uVrmOwlKkWoPX73YfvhakDxPbQ26AThr1z7XaQIsk4XzpNfSittlqqUpdxq1fEfbvGVlGRGlt4x80O0eCYfFCpHaYMymxsnx6f32wuXngDL+LqJc96sVavm6EXSVWLMOL+rrn1qIhwwmSpxdkm1NZglym0gVc2ZFTTw1lRMg+qZj70OkSKb4KWWZihXb0k7nlgdCt759rdcEySwKJ5gBghiej/aiuPp9bmtEARpM5uNr/btN9KaqtucEyAXnBGOLIixbe3Hz+/ub7ovRV1PPQWHu7q9SPvDDNQuRWOnSQ9RVNG/Vtc/pTq2AqjnQiYEYLahHpbcxBGah0X2lj74N8C1hwBY1JpbHzY+DOHwqvmPc6H3nwjWr3+SUYYl8JRJImKfqjsnqgiKBNR0hdnNSRlMBlUPD9yEiaPbMBEDWf+Y+9qQlspo6g/4EpF8Gcj/rt24UIEwY0bde1SQQQRGmOdR7UdrM+MjDJTR0x4ZBRHGLCbScD8IM0iSlIIGkMIjlG0YmuQRkWhWEU3rjzf/eabm0xGd7azmLt6r026Otx77r3nnq/0/N7WKRHgvbfegaU4tDKP3s+IuOl2AOa2f1f13plLNLMaVySbJN0R90em1cPIhU8FfNShno4gKlNfAYxYJ7SocCnIFLq9k8gk5I23jn6F8OGlp2KfoOuFPcht/6HqvSUXgWc0uElaHvVWB45zdKzb0eFsy/Jds2AXmKkkttZNWbig4Yyj1zrpYcFEkHk2+GP30vvCJ4jPUW677j/I7TX5NCabETVJugQMj3rdwNkehAEAoDwSvTqMP46l8GEZL5R1Agz2fK8eIwYdlmeekEkI+Z3BvOqVJctDZBi2M+O4Jm+pMx2Ro3OBw7Fp6DIUh7JuG9sBOZUZmn6hO6zixi2xglwsXD6+EAPmoMXWrWJb0P0SxynK8pBVvUnD39vzNVKWI2ncoBfa1FIDJsgwJvbUyiOxNMUO0m1aQWMJMXpjWlA3bmig+Je6qGxNk6xbCTLvvHMCxCSF4VeuGP7mBg5ZjtVNUr0e6Rjsdh2D27bnI6lIA4ftoeeb4VEXNWuBv7h16o+k3IoyDN+rkHUrqMxWpOGcS8hcdy2reu9YlWjmo97MxtWJJokkmm40/Mf+CBnGb6mkAnBgKW0ddBs02FOAMb3WQJn7ThsMJTYJISpDgryX//xJ1qVYGXPbrSsWMTTqzZNMJuPu2KyMAeP6ljqldlBXQGbD426EAAgf5gfddhPbAkcBxq8BFNFgz9FXyNCgRZA53duibcFW8CYQcxc7PiDZJB0fxOP5OZHJZKgmieuI3avS1WO0lLZL8Ej0DrY5Z/Sm3QYW170ol0Cf6dVMJQPm0GESQoVKUZkB9gVbVJc8JJkLF1L8oZkNX5lLNLMZq02SXqIq0mpGV4+2MwzmyDAqkFmctlvzw0GED7sg+iN2fOC2mv3OoJWp1fde3pNU5q3T+e+7L23wbUGa3XM+uMtkcJOkgqqIS6fUA+UKMxAZhouWXsLQxTp29AUpDHJIs0Xch1NVuHCv4lfN57d+i6nM6dcb7764gW1Bsh4pNnxLnmEyGdwkqeCrR6YyDBemMpRheDbca4ov1CB8YMC0RKGK9Vj+29uN+KG3N1798Pud3Y315FMXN1yZG9xlOeK3QRdrknpjy4+pjB5Dg6nMgDIMd9Ck4WxZPLhzemLBpAoVPoAxDlu3knnV7s76+oMPLI/tcoO7LMfN8SaJI7aaqgkqozrmZDg2f4c76JovAMMLpqa8V7EJQNgseJjKsKX4G5/9/O7mOlEZPsXPDe6yHPzsDeeXwZSvHqONIjMTjsUrSFtpOC3OMHyvUu3ZuuTP8qG3k/iht1f3vth898X1BSpz4+3SUjxX9WYzUpokvV7txVVEUhnlkZgMziVUuGgFGQOGX49s9Wy7bXclpuiht5NoW7CHM8nPL13aWOczyetJw4l33HLIZDGeYM7Lg7uWRaNelsKwOCo9UGpk4dL5XJ/vVfywZ3etX6fdbQnCOurSidoWYMH07V+7L60/RlMZ1nBemQ/uMhlPpgCm7kmDOzs+HjEllbH/HTAuCteK8MFWC6ZA79Z+/93DfkHdq9SIykSW4m+ByrxAVIbfccslmpmMlCZJt6ndqUFApduKyrhMZdIBg9PqZOHSC0fDaMHUKHRrcFEMu7YdcZ2afB1lS56jgMq8IFrsRQ1nnmGyGOoOf6nhkQtDIdEs2ZGBQ+SRSKrelHAaiVGvsoGQR3C2IwEz79oNJBj1Zq3ZgqW48uH86rtLO+uLVOaqvLnOYHCTxCEN7prhwNk+ZgNwXyCiekRZZzXs0sAV5r7gPjzppSO42FLc+h2A2e4FkusQlfGOP9o6PY1f7fpldxNUJr4tyLfVGQxukhI1xmmbAQATmtO4YwYirIEUhnOsOD6YjSWJZq0p6LKOv9gd/gTADELFdZDHLJDh45YyCXn15U/Xdl8UVCaPzAY3SSuKy1IbN2st1R+xMPz4uMBMZcXxwa9xW+0cuC3f97ygQ9SlWxjCIbolKpsjQdie2vagdXLCPpxfbu5urD18f55cshrJJomW1cOSlMJAolnlUS8QMaz1hDBc2T1z8KjX8xkwOkwUPc9tVr2JJiCDbzn4i8x1HBwh9Kogv8pSHI4P3+3uXFiDpXgeWYz0TVLdVAbg8dVjpOptUI4gO7P0utToLYjA9dK+MTKrM0DGHRu2LlDIa21bfmVoWs06LMVPt6JtAajMNziTzFeQWYy0JgmDO49SAB+P1BR3dRyRI0xTesgvR/SiUrthK7g899pr5Up57Fabrlc1R/uADPVHLXCd8Gg7bslaLlmKfxybVwlL8XtuuiyPzMVyk8QSTdNqHZfSR712tB6abifw0lbvuEV56mLxNaNcLJYrxYlVdV1BZfYFlZFrbXgVMV1GzZvWhPBBmVc9/fcff/wB4UMeGYu0Jkm3B1Vqd1R/JDvmlqoiDq2H3CRgtg+sA9AcBbq3tdeKxX65ohWLRqVfrwoqY02eE0nGxqiXMgyTbHxbsCVhKU7Ch7cGP/39x/sXHszXSRmL1CbJjg3Ah6o/opfPPVPYOysP+RXATC2p6lXVqFgu181+xSgWixVj7IPKWFV/dBG/lZbizmJSQxfvuZawFN+KziTdN7/ZXMtb7IxFqtxOGYDzcb2sIj4aoFIkn2sHU2cFMKZLbJiqUbEIwATz5qRYiepSU1CZWad80dZXxTQkfAiH3b1nyfEBdemN0y82LokW+7I8MhNXP8tN0uqol/sjWhiiY25020o+Z5f0BGCGlkVsuPC2gAsBpu41q/4YxFfUpc7hzJu5HaNDVEa3Vyd/SFCFDwPWcH7y+Us762s5lclOsKPzUthK1VsjKgMCK4UsNVxBwhZR7pyX8MJsuGb1AQ+KshGETXeG/sgwihGVsTqVThNUxtbTLcX1Ur1GGk75AOlrf+1urq09mM/xMhLcJCX86mxW9boe2Iot65C4goSOYbg6g9HVqNdq9o2iQkxnYnkuWuqgI36mgcqA1HSs0JctdjJE4imYFjs+kPDh0os5lclKpG6S9EIPw39W9aIfiiDkgJsiiXi9lPywbQtIXZzMqgwYUYcC6o+8caWoEZVBSWo2vWq9vy9AliL7PEo4Pjz7xYWcymQlUpskzGFCuoONfFSRYfTeAIiQEpcaitIKYOzBERSYF4GIfsCAoaQyEv1ReFgplon9lo2OmMpgW2C8vZpk2PHhRD30JqjMDqgMhA95nHNc/rjivMnBnUt3sJErzMG20wvjhWFjEK5mGCcIe23qoDGr46D+SMOoN5xUypMxfUAr07agWi8XjXQqIwRcQsOpHnp7h4QPaxA+5HGuwZukRFWARNPEW31qa92wbUzzm/FzodMDfQUwSETeYUcgQtMYMDKpoD+aH1aMeig/UKRtAQBjjMf7jp4GGSwxlyzFX9369D1QmUfzunSewU1SAjDU7ljTbiHyCbLFRZoURxGEUlzA7fpcbBjl0IXzy+HYqBCVGY0NI6iqDwBCk6pZrhzO6/0V9qurexVv0VL81Y++fHFnPacy5xrcJCViW1p6FMyFrTWJo5Tdc5Ilv10GU7HEJJcQErfV9XnQp6yDQoUM487oA3JbAOxMqqAyxWUqg9ZavVA6hKW4dK6KNJw7m2s5lTnPeGb1Dp8tPUB1g6rFo1718nmyhmBt9NxrSBxykov2p6wpwJSRVGaTjkgqWtEYqw8YBrFhAAYQCseV5zB+YbBOA75XEf7QRH2VhhN16b2cypxTpDdJbOmBcxMXVEL4qLKTVBOHjTykjddGkql4HtqfWceIAVMPSQqjUZ1SH/AOJYQ0Y4RPeyOkpIuADFuK870K+UPHdellUJm1Sxs5lTmn4CYpBS20IuxVMbn1goKteEWr6btDPM/GS2laG6mhC9ofr8mDOyCCkkp4WNbKZd5aA0L4L8IAhOYjUaK0twt6vJJatiYq8VMXUsOZbwvOJbhJUpyXWcRBoyuHLmLU65tYBbCTlNXeLvWOUDBYxKBCQ/vjh7MIMCqpVF2vDnwYhvxATXCdMNDKEYTMcUUTjdVzoDLq0QJaYvK9Cj91QRpOsS14Lxc+nEOkN0miFNUOYgMHF07N3Xb8lsnUh2d8vSqED1SNiktBYikGTJRUwqBsTA7RNMVb65nfiSBkaB2NQtUlG57jQn1Djg8U6qkLRWWwLdjNtwXnEckmiZ+/IWWLSirYUTc8X92GNJBvApeED/tEXhgthmx/gIXlUa+LDnoyB0a0aGvthWax0pdUBolGiyFDhZDVNyrHJKnM3tfrO/m24OyDm6RkhmktPpCEG4KG7ypeIYazYrBnNQ8JGYyX0ciIOug4DDl0GYmGyEPmibbWI9/tVPohqIxR1DjwZRI+ROqbVpta+jQqA/OqF15ay6nMGQerp5L7P4sM7o6jUwGxcqzxbYjQMbRcdzY/RErhqIxDyhkcWnFEPzAMzZjMm33smTqRmmoEwGAFafYNbSGw3S4CkMqaiAGTpDJkXrWz+d7ag/lU5uyC3wZNhO7EUhhJbu3CsdsUSUWNegtjN7S8oLwMmGo10tfFbbXpIuvQP0FlABioeouGrF7GCA1UOME/OMsYnVlztO88H9nI8As7KVTm1TcgfLjw3mM5lTmzuDu1SWIbIJ9VvTaojBr1CgUmDV3mgZEAjJjkjowyAyYIcSoQ7STHAAzmdn6/HO0NIHzwJpUODfYUYPyqED448raAr7RTqMyeMK+6sLP+Xk5lzirSmyT2UWVVb7QtEO7N3sCGAlM2xMsZxhjNaJIbUDvEEk2l6jXKRp+EDhHMyhA+zAEYzx2rJGN0XAuy30O6rF2yFE+nMkLDCSrzyGV5nEXw26DJUK4wRGX8I2UsBF5h1uqaAojWT/TUHbqLBbmN26bDcOYqVS8tI0VSMTTuwceVjut5WCdIDqMFoRzsXUwRPjCVIcRE5lU/ijneZXmcQbCjc3Jw13Big7taYtQbmgsJpLgchjHCJHdRoqlFV4/1UYWoCz7AVFlSmY6HrBNI7os/iXMUIQNmDWdKcF0SGs4v4RFy72V5pMcZNEkY8AbKFcYWV4+1esmWxkLO/sj3AZi0KFP7YwAhDBhaMAl9ndLKlIWMigsZCpGkMgARBZ+jeKAyySSTOpV5463vPnj9vsvy+H8j+TZoUqLp86gXGaaEWRq2BVgbiYZYS8VLX3XMkwgwPOpFoWIqs9x4a5LKBNxdGxVZ2RLCh3+nMu88/8MPD12Wxz/sXUtvG1UYzYYFv4EtQoIVYgGoFagV4lWxQIUNSCx4CKQYTzzBSXAexgN2MMEKDolrGgNxadLYDkmcpLitS5OBUoobHEJ5FWhJUYIQQmKHBDvO/e69vp7xOI8CHVvqoYVSUh7y4XznfN937/2fYX8b1L6iWd3qDWM2kMpe0oaoingdYZRnxaaLUU0jnbV6aSUzSlYGf24hDImKfhHTSQn8giFUtjXUpZKBxYctrUzfBz9fU5j/HSokBeyEoavpKB/Ji1fpxvfoaraE5ah6MJZXEYjFiqa91at2ZcjKKOgMfKikQDNKLD7ADIlpgR3qYWwizB/9t7ZcgyOuUkiifAT3IlZhYr7Y0uqa/MCdoGnmcmqWBWL6AtWHKRtyqzelrIyCLqAEBhImf8Hqklp8cETyQzqI4uvuvmZ6rwKcQxIhJi4AT6z3soAUSMYj+MBn5e6THVowGDRLfNOlrONTVn2YDeSjIRmgeGKu7gXrNYgvVXY4cyVDLT44IXSSLq0KTXTf3HINjvjfQ5I6tcpavXlcgTgTeI3dC6R2n3QbZTTGF3wvyUBcvaKZSlGrl596FGu/JTCiLmGMUorpmE5DTMvigwM+IIUpTHTf1HINzvh/J0n2CxxW13uL62F5NoQ+cHFSWoHowmAGywdIhaoad7lVykcFuQqjrExdwizNrq6RjlXXKWcrQx7mxb6/J66FpKuAG4kvMiQ531eXOR0zyxvRcsT+gRuKLoDGYZiFxahlRTPO89FGRqxoysRMjKinMGuzXMcgMooxEQcrE/K9SP8Jf01cC0nO+P9Dkn0Eqek4ChJFc9Zr+cATy4aFLvhIuciYSzmlMAC/4I6taBYojxuUmLmViTsTpjBWufFBBxRlaqxMaIFC0smfr4Wkerg6IUkdHzHikSEssqRAGPGBG2zPmw0QITiaJugCjxH0SsosjynCiLizkcOKZk62epezzOuschLqdmAxvExDTHgfZobYtzpWJiRCUn9/Y4ekW27ev3//LU1vs0RIqk8XT5BtYMbxgbNzrhn6wEWLBGssmBuaJuOLjhTj8/mSGqdM0CxoQc3a6h3LsRXNA+ouKjCClmmUiCioGx9Q2zSN/gkOVkaFpJnJRglJ1+25s4YX1+1/7BDDwYOP7G9uzqiQ5MwXeY2UYSyNZQzj4kbVMdfVDDspnSmYGpAM+BgCSVDHYJQBJGUM4ph3CY3ghMxHcjHcMMoZ/B31WpCOrWHsbQa5ihFlRMT2BOwhKd0YIWn3s8/MT09PP/V09RLgbU+OHxKEAR65paVpoUKSM110teCNDxyLCgk6ByuMyHLQXEyl1sqapgd9Ep5gYckAZeSHjHKyzAdMtKLJJ4pDorIdyBk4Wi2mBTaAYzpb6UNtY6zVGP8UZWRdCvmeb6CQdP3T88D0/DRQoczNj42PjxNdOGEGBx9pCG7/hyFJHWa0DqKhMCoQayhGZi7Bbjg0DAMVSQCPJqHpUqEMW9FMyVUYeSzyYmWrl/nptUQO5tbBycRNbTFVIjMUiYAy8NUWK9NoIeneZ44RYQhTU/tbgJseGSe+EIgvYM

Emails

href="mailto:[email protected]">[email protected]</a><br>

href="mailto:[email protected]">[email protected]</a>

URLs

http-equiv="X-UA-Compatible"

http://meyerweb.com/eric/tools/css/reset/

Signatures

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012235-55.dat	family_medusalocker
behavioral1/files/0x0008000000012235-56.dat	family_medusalocker

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 1 IoCs

pid	Process
1744	svhost.exe

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\FormatProtect.tif => C:\Users\Admin\Pictures\FormatProtect.tif.keversen	1.exe
File renamed	C:\Users\Admin\Pictures\FormatSplit.crw => C:\Users\Admin\Pictures\FormatSplit.crw.keversen	1.exe
File renamed	C:\Users\Admin\Pictures\SwitchConvert.raw => C:\Users\Admin\Pictures\SwitchConvert.raw.keversen	1.exe
File renamed	C:\Users\Admin\Pictures\UnpublishReset.raw => C:\Users\Admin\Pictures\UnpublishReset.raw.keversen	1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-3846991908-3261386348-1409841751-1000\desktop.ini	1.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	1.exe
File opened (read-only)	\??\Q:	1.exe
File opened (read-only)	\??\U:	1.exe
File opened (read-only)	\??\V:	1.exe
File opened (read-only)	\??\W:	1.exe
File opened (read-only)	\??\A:	1.exe
File opened (read-only)	\??\F:	1.exe
File opened (read-only)	\??\J:	1.exe
File opened (read-only)	\??\N:	1.exe
File opened (read-only)	\??\P:	1.exe
File opened (read-only)	\??\R:	1.exe
File opened (read-only)	\??\S:	1.exe
File opened (read-only)	\??\I:	1.exe
File opened (read-only)	\??\K:	1.exe
File opened (read-only)	\??\M:	1.exe
File opened (read-only)	\??\O:	1.exe
File opened (read-only)	\??\B:	1.exe
File opened (read-only)	\??\E:	1.exe
File opened (read-only)	\??\H:	1.exe
File opened (read-only)	\??\Y:	1.exe
File opened (read-only)	\??\Z:	1.exe
File opened (read-only)	\??\G:	1.exe
File opened (read-only)	\??\T:	1.exe
File opened (read-only)	\??\X:	1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
524	vssadmin.exe
1844	vssadmin.exe
1588	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe
1712	1.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeBackupPrivilege	892	vssvc.exe
Token: SeRestorePrivilege	892	vssvc.exe
Token: SeAuditPrivilege	892	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1828	wmic.exe
Token: SeSecurityPrivilege	1828	wmic.exe
Token: SeTakeOwnershipPrivilege	1828	wmic.exe
Token: SeLoadDriverPrivilege	1828	wmic.exe
Token: SeSystemProfilePrivilege	1828	wmic.exe
Token: SeSystemtimePrivilege	1828	wmic.exe
Token: SeProfSingleProcessPrivilege	1828	wmic.exe
Token: SeIncBasePriorityPrivilege	1828	wmic.exe
Token: SeCreatePagefilePrivilege	1828	wmic.exe
Token: SeBackupPrivilege	1828	wmic.exe
Token: SeRestorePrivilege	1828	wmic.exe
Token: SeShutdownPrivilege	1828	wmic.exe
Token: SeDebugPrivilege	1828	wmic.exe
Token: SeSystemEnvironmentPrivilege	1828	wmic.exe
Token: SeRemoteShutdownPrivilege	1828	wmic.exe
Token: SeUndockPrivilege	1828	wmic.exe
Token: SeManageVolumePrivilege	1828	wmic.exe
Token: 33	1828	wmic.exe
Token: 34	1828	wmic.exe
Token: 35	1828	wmic.exe
Token: SeIncreaseQuotaPrivilege	1100	wmic.exe
Token: SeSecurityPrivilege	1100	wmic.exe
Token: SeTakeOwnershipPrivilege	1100	wmic.exe
Token: SeLoadDriverPrivilege	1100	wmic.exe
Token: SeSystemProfilePrivilege	1100	wmic.exe
Token: SeSystemtimePrivilege	1100	wmic.exe
Token: SeProfSingleProcessPrivilege	1100	wmic.exe
Token: SeIncBasePriorityPrivilege	1100	wmic.exe
Token: SeCreatePagefilePrivilege	1100	wmic.exe
Token: SeBackupPrivilege	1100	wmic.exe
Token: SeRestorePrivilege	1100	wmic.exe
Token: SeShutdownPrivilege	1100	wmic.exe
Token: SeDebugPrivilege	1100	wmic.exe
Token: SeSystemEnvironmentPrivilege	1100	wmic.exe
Token: SeRemoteShutdownPrivilege	1100	wmic.exe
Token: SeUndockPrivilege	1100	wmic.exe
Token: SeManageVolumePrivilege	1100	wmic.exe
Token: 33	1100	wmic.exe
Token: 34	1100	wmic.exe
Token: 35	1100	wmic.exe
Token: SeIncreaseQuotaPrivilege	992	wmic.exe
Token: SeSecurityPrivilege	992	wmic.exe
Token: SeTakeOwnershipPrivilege	992	wmic.exe
Token: SeLoadDriverPrivilege	992	wmic.exe
Token: SeSystemProfilePrivilege	992	wmic.exe
Token: SeSystemtimePrivilege	992	wmic.exe
Token: SeProfSingleProcessPrivilege	992	wmic.exe
Token: SeIncBasePriorityPrivilege	992	wmic.exe
Token: SeCreatePagefilePrivilege	992	wmic.exe
Token: SeBackupPrivilege	992	wmic.exe
Token: SeRestorePrivilege	992	wmic.exe
Token: SeShutdownPrivilege	992	wmic.exe
Token: SeDebugPrivilege	992	wmic.exe
Token: SeSystemEnvironmentPrivilege	992	wmic.exe
Token: SeRemoteShutdownPrivilege	992	wmic.exe
Token: SeUndockPrivilege	992	wmic.exe
Token: SeManageVolumePrivilege	992	wmic.exe
Token: 33	992	wmic.exe
Token: 34	992	wmic.exe
Token: 35	992	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 524	1712	1.exe	27
PID 1712 wrote to memory of 524	1712	1.exe	27
PID 1712 wrote to memory of 524	1712	1.exe	27
PID 1712 wrote to memory of 524	1712	1.exe	27
PID 1712 wrote to memory of 1828	1712	1.exe	30
PID 1712 wrote to memory of 1828	1712	1.exe	30
PID 1712 wrote to memory of 1828	1712	1.exe	30
PID 1712 wrote to memory of 1828	1712	1.exe	30
PID 1712 wrote to memory of 1844	1712	1.exe	32
PID 1712 wrote to memory of 1844	1712	1.exe	32
PID 1712 wrote to memory of 1844	1712	1.exe	32
PID 1712 wrote to memory of 1844	1712	1.exe	32
PID 1712 wrote to memory of 1100	1712	1.exe	34
PID 1712 wrote to memory of 1100	1712	1.exe	34
PID 1712 wrote to memory of 1100	1712	1.exe	34
PID 1712 wrote to memory of 1100	1712	1.exe	34
PID 1712 wrote to memory of 1588	1712	1.exe	36
PID 1712 wrote to memory of 1588	1712	1.exe	36
PID 1712 wrote to memory of 1588	1712	1.exe	36
PID 1712 wrote to memory of 1588	1712	1.exe	36
PID 1712 wrote to memory of 992	1712	1.exe	38
PID 1712 wrote to memory of 992	1712	1.exe	38
PID 1712 wrote to memory of 992	1712	1.exe	38
PID 1712 wrote to memory of 992	1712	1.exe	38
PID 1104 wrote to memory of 1744	1104	taskeng.exe	43
PID 1104 wrote to memory of 1744	1104	taskeng.exe	43
PID 1104 wrote to memory of 1744	1104	taskeng.exe	43
PID 1104 wrote to memory of 1744	1104	taskeng.exe	43

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	1.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:524
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:1844
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:1588
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\taskeng.exe
taskeng.exe {D4544CD1-151D-4A27-B5AC-50035EF8333F} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Roaming\svhost.exe
  C:\Users\Admin\AppData\Roaming\svhost.exe
  2⤵
  - Executes dropped EXE
  PID:1744