medusalocker | 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a | Triage

Submit
Reports

Overview

overview

Static

static

6cd8d4ae87...2a.exe

windows7-x64

6cd8d4ae87...2a.exe

windows10-2004-x64

Sharing

General

Target

6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
Size

669KB
Sample

221029-j8kckshgbl
MD5

87fc357cfaa43f6766a5efef072871bc
SHA1

ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
SHA256

6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
SHA512

2fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436
SSDEEP

12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DhKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWIKrKe

Score

10^/10

medusalocker evasion ransomware trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe

Resource

win7-20220812-en

medusalocker evasion ransomware trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe

Resource

win10v2004-20220812-en

medusalocker evasion ransomware trojan

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
- Size
  
  669KB
- MD5
  
  87fc357cfaa43f6766a5efef072871bc
- SHA1
  
  ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
- SHA256
  
  6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
- SHA512
  
  2fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436
- SSDEEP
  
  12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DhKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWIKrKe
Score

10^/10

medusalocker evasion ransomware trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

medusalockerevasionransomwaretrojan

behavioral2

medusalockerevasionransomwaretrojan

© 2018-2024

Terms | Privacy