General
-
Target
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.zip
-
Size
29KB
-
Sample
230420-ssddrscf5z
-
MD5
0f025715a5cb507fc46a4df12cfa74d4
-
SHA1
f8b2c1eb3d8c77aa3dd57e5b86018d10c2f5c4fc
-
SHA256
2f3446c2b663193e85c11e08af62a74abc28b44ed3d43f815b78b22dd4a25c35
-
SHA512
43d18b7885e3dff68f6f42737717b2bfa9ca4756ac813be077d2c119936ccf7cdd319c20f24cda2733dbb1857be4bb5b1d793674f5424c1a9bc36ed8d25670d9
-
SSDEEP
384:cGTTnA+Q+BN166R5aeGxlEmeaX+4nsPpU8vP2T+jdoCFuj4mfuCMG8Isrlde:RTsWHplmvnsxUEP6Ko4mfHlx
Static task
static1
Behavioral task
behavioral1
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win7-20230220-en
Malware Config
Extracted
C:\ProgramData\regid.1991-06.com.microsoft\how_to_back_files.html
Extracted
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p4wuoroe.default-release\how_to_back_files.html
medusalocker
Extracted
C:\Users\Public\Music\Sample Music\how_to_back_files.html
Extracted
C:\Users\Public\Desktop\how_to_back_files.html
medusalocker
Targets
-
-
Target
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
-
Size
53KB
-
MD5
5efa19dc204e46e8d8c57482f80e7a40
-
SHA1
5c83b3ddc8417fe64e0bbd3495445ddcee52e35e
-
SHA256
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f
-
SHA512
0cdf4a1263b9a341240acea245155f0afbaac864eccd1d9623a9a152a9287e8a65cd62f12804d5a1293c9d960a4958c2aa05a720f35d42699fec5d4ac0accfc1
-
SSDEEP
768:FKcvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5YW:F9eytM3alnawrRIwxVSHMweio3+
-
Downloads MZ/PE file
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Stops running service(s)
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-