Overview

overview

10

Static

static

10

7a073ba748...52.exe

windows10-2004-x64

10

Resubmissions

14-10-2022 17:21

221014-vw74nadhc2 10

14-10-2022 14:20

221014-rnewcsdeh4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a073ba748c752fa795254cb4019c282ef03a0283602a43f5481a49d17323152

  • Size

    669KB

  • Sample

    221014-vw74nadhc2

  • MD5

    a65e340a616178bceb72e056554ca8d6

  • SHA1

    00f95a3e9e1ce53e4476c770e61f08c110d3beae

  • SHA256

    7a073ba748c752fa795254cb4019c282ef03a0283602a43f5481a49d17323152

  • SHA512

    cd3f6baa05dbd5b8d345c5a7c084eb389ca1b2e9d6cfc212f58742e5a943927dbb4ae8d16f7fe12bee315cc4e3b8ec11916513e2ff0538af6b8848bbbd21e720

  • SSDEEP

    12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DiKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW7KrKe

Score
10/10
medusalockerevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">8810510BACF39BF030C33F52CBF6315DCE89A24355CB65AAFF99207DB2C65A7A480263F3CEC65E08ED17B21490A4232A6B83EA1FAD62BD48E28D2AB1BD017E4C<br>C4797F17341EC3B1C4560D49CFA507DABA490E036FA3B3944EE7FCBF70D39C7EE385194A06427EEBC2F8E9493F018FC30968A04EE24722CD325AECE93A5C<br>B82FE623FE0DFF0F54AD1E031AF1FD2FFD593EFD818E3E7231E8B43FE9E188EAEF3E19E6E8FF3D29F90CB7990E8DFDF415079964C8527E769211C9C4511A<br>A35520701F8A8A4B76CB1B009C398D2246BA645C71B7CFA41FD2B5BA558C04E35CDA3A345A12994629E101E6370DF454253EBA2C4F4DB4C308DFDD43EE68<br>6738775C00AD424682B1687CD7559A200312ECCF0AEBBED64EB40F02F7D19FEBDE4D444B3699861721D1EFFE4A296E9C8A1A54B34BBBED898C80260B36E4<br>089C291BB7A7E624AF76BD85D751CC596C73AA222EE6599ABCB02CAE8D3E9165ADEB167777DA202B2FC8D0FC28053151B9DF78C4B59491B336952AD51F26<br>31988D993EDDC0739D6E51E75B68532F46B2E37E984CCB6245E984F087F66D70865C32260409B99C0CA40B7379D8E39E5731AE6C5F8D0A30D777EB0ACC55<br>DF3D4AA4FD0B492BC00B89B3C1225DF121F55489672015DBDC91ADE4154ADC7687C5A9722599D550C625CD2B5CDA7576447AC8C25F5CF1C31EA73CE3C695<br>B99EAA84D49A2923C26BAB5632A1</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html

Family

medusalocker

Ransom Note
Your personal ID: 8810510BACF39BF030C33F52CBF6315DCE89A24355CB65AAFF99207DB2C65A7A480263F3CEC65E08ED17B21490A4232A6B83EA1FAD62BD48E28D2AB1BD017E4C C4797F17341EC3B1C4560D49CFA507DABA490E036FA3B3944EE7FCBF70D39C7EE385194A06427EEBC2F8E9493F018FC30968A04EE24722CD325AECE93A5C B82FE623FE0DFF0F54AD1E031AF1FD2FFD593EFD818E3E7231E8B43FE9E188EAEF3E19E6E8FF3D29F90CB7990E8DFDF415079964C8527E769211C9C4511A A35520701F8A8A4B76CB1B009C398D2246BA645C71B7CFA41FD2B5BA558C04E35CDA3A345A12994629E101E6370DF454253EBA2C4F4DB4C308DFDD43EE68 6738775C00AD424682B1687CD7559A200312ECCF0AEBBED64EB40F02F7D19FEBDE4D444B3699861721D1EFFE4A296E9C8A1A54B34BBBED898C80260B36E4 089C291BB7A7E624AF76BD85D751CC596C73AA222EE6599ABCB02CAE8D3E9165ADEB167777DA202B2FC8D0FC28053151B9DF78C4B59491B336952AD51F26 31988D993EDDC0739D6E51E75B68532F46B2E37E984CCB6245E984F087F66D70865C32260409B99C0CA40B7379D8E39E5731AE6C5F8D0A30D777EB0ACC55 DF3D4AA4FD0B492BC00B89B3C1225DF121F55489672015DBDC91ADE4154ADC7687C5A9722599D550C625CD2B5CDA7576447AC8C25F5CF1C31EA73CE3C695 B99EAA84D49A2923C26BAB5632A1 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Targets

    • Target

      7a073ba748c752fa795254cb4019c282ef03a0283602a43f5481a49d17323152

    • Size

      669KB

    • MD5

      a65e340a616178bceb72e056554ca8d6

    • SHA1

      00f95a3e9e1ce53e4476c770e61f08c110d3beae

    • SHA256

      7a073ba748c752fa795254cb4019c282ef03a0283602a43f5481a49d17323152

    • SHA512

      cd3f6baa05dbd5b8d345c5a7c084eb389ca1b2e9d6cfc212f58742e5a943927dbb4ae8d16f7fe12bee315cc4e3b8ec11916513e2ff0538af6b8848bbbd21e720

    • SSDEEP

      12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DiKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW7KrKe

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojan

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks