Analysis
-
max time kernel
175s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01/02/2022, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe
Resource
win10v2004-en-20220112
General
-
Target
dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe
-
Size
661KB
-
MD5
19ddac9782acd73f66c5fe040e86ddee
-
SHA1
24ceba1e2951cde8e41939da21c6ba3030fc531d
-
SHA256
dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95
-
SHA512
e7be7472241fdd26db48dbd0311afe821905f6d59dfb56e3dc035944b7346b0767a8af76d110c5f60c0ba0183ca3791e56d9b3c8b9ba887afa111aafc949c1d4
Malware Config
Extracted
C:\HOW_TO_RECOVER_DATA.html
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
http-equiv="X-UA-Compatible"
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload 2 IoCs
resource yara_rule behavioral2/files/0x000e0000000220e6-130.dat family_medusalocker behavioral2/files/0x000e0000000220e6-131.dat family_medusalocker -
Executes dropped EXE 1 IoCs
pid Process 2852 svchostt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\H: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\Q: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\R: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\X: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\Y: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\A: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\K: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\G: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\J: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\L: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\M: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\P: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\S: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\B: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\E: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\T: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\U: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\O: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\V: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\W: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\Z: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\I: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe File opened (read-only) \??\N: dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3808 wmic.exe Token: SeSecurityPrivilege 3808 wmic.exe Token: SeTakeOwnershipPrivilege 3808 wmic.exe Token: SeLoadDriverPrivilege 3808 wmic.exe Token: SeSystemProfilePrivilege 3808 wmic.exe Token: SeSystemtimePrivilege 3808 wmic.exe Token: SeProfSingleProcessPrivilege 3808 wmic.exe Token: SeIncBasePriorityPrivilege 3808 wmic.exe Token: SeCreatePagefilePrivilege 3808 wmic.exe Token: SeBackupPrivilege 3808 wmic.exe Token: SeRestorePrivilege 3808 wmic.exe Token: SeShutdownPrivilege 3808 wmic.exe Token: SeDebugPrivilege 3808 wmic.exe Token: SeSystemEnvironmentPrivilege 3808 wmic.exe Token: SeRemoteShutdownPrivilege 3808 wmic.exe Token: SeUndockPrivilege 3808 wmic.exe Token: SeManageVolumePrivilege 3808 wmic.exe Token: 33 3808 wmic.exe Token: 34 3808 wmic.exe Token: 35 3808 wmic.exe Token: 36 3808 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1716 wrote to memory of 3808 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 57 PID 1716 wrote to memory of 3808 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 57 PID 1716 wrote to memory of 3808 1716 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe 57 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe"C:\Users\Admin\AppData\Local\Temp\dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95.exe"1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1716 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:2772
-
C:\Users\Admin\AppData\Roaming\svchostt.exeC:\Users\Admin\AppData\Roaming\svchostt.exe1⤵
- Executes dropped EXE
PID:2852