Overview

overview

10

Static

static

10

medusa.exe

windows7-x64

10

medusa.exe

windows10-2004-x64

10

Resubmissions

30-11-2023 10:51

231130-mx5qxsah79 10

29-06-2023 20:59

230629-zs72psfa95 10

29-06-2023 16:29

230629-tzp7ksec27 10

Analysis

  • max time kernel
    1800s
  • max time network
    1233s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-06-2023 20:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    medusa.exe

  • Size

    235KB

  • MD5

    f6f120d1262b88f79debb5d848ac7db9

  • SHA1

    1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

  • SHA256

    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

  • SHA512

    1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

  • SSDEEP

    6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e

Score
10/10
medusalockerevasionransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">1087F9AC7D018DC3DE488E8D954C2D0E02A5C685590966B71042E41A861523D256AA39CEE93E12FFDE9FDCA560D72C0578ABE7A7F0CC9E01D73766723D29E3DD<br>666757EC29C36D9FD8B32E4F79DD0443DF1482678F239B0FD3565ED62C138F62AFD8B21893C00300259AC964BBADCFD95427E4C824BF6F759CCCA62D8A79<br>E8E636799A5087808F3A8040FD4A1A004A6C2AA15EE24E63FC751CC976D1F0A3141FB7B307B614B900D6D3B32FEC9C6D84930489C2E5C19FFD052C9335C6<br>AE33BA4816E205FE621391709628A5D2C9143D621C19744D36A34583BE12E658118FF30E4072D2C9E0F90796EFB998C7128F358A07685B689B67373C8B05<br>EDBFF9D01A4194511AA381F3F663BBCB2E282C8DF311C53E4FB9A1B69C4018C30CA3A57A1754F27C61F676BCB8970550E6AE11350A067A83E6F22072986B<br>451F0CF71027F9962FBED37B0B8CD96459C4A5540E4994629C9893E8A50968203204B7F9D065FE205AA0BC1F4991578423598CDDB51AC66020A400713816<br>9446991C13906C605D8D49C24A3DF0B44523416472909F2EAD88D632434F9EFBA8E5D0F4F6E3775D60B7E8998143B9C1B38A6B7FD4E68BCDC12858EF875E<br>C1F7761425DCB65A49109FF5BB92818076FAA68634EE24A5A4A5BA0DB58DD88A57AE9481073807A5CF684A7872920F2BA3D2B6E9B833D369EBB99E2B9F8D<br>984A49ADCD20247580D0E4E5B50B</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 50 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Renames multiple (193) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\medusa.exe
    "C:\Users\Admin\AppData\Local\Temp\medusa.exe"
    1⤵
    • UAC bypass
    • Modifies extensions of user files
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:456
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2348
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2880
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1036
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    PID:1996
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    PID:1204

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    235KB

    MD5

    f6f120d1262b88f79debb5d848ac7db9

    SHA1

    1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

    SHA256

    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    SHA512

    1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    235KB

    MD5

    f6f120d1262b88f79debb5d848ac7db9

    SHA1

    1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

    SHA256

    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    SHA512

    1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    235KB

    MD5

    f6f120d1262b88f79debb5d848ac7db9

    SHA1

    1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

    SHA256

    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    SHA512

    1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

    Download Submit

  • C:\Users\Default\ntuser.dat.LOG2
    Filesize

    536B

    MD5

    709734d8e4aaf4da3200ca16c9d25016

    SHA1

    7a540a45643594f8d7fc1afed6132872eae86023

    SHA256

    c792586a0ec5b6b46cb4462709426c8ed2b0e17b36530aea181747f970b95f79

    SHA512

    52731572df805757e6d82234a30d01c9315144fde1dacd419c8b8a5f2ee4739b29d66ec04aaa35188533f4cb99f1b69e4bf0507a4081c09e0c925bd6750f4f89

    Download Submit

  • \Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
    Filesize

    4KB

    MD5

    0f3ccb2b4f2eee3edc8a7a430c93636b

    SHA1

    6ff91d68b557b262927517d7b00713635fe90429

    SHA256

    4ed876b316d0802c05a5d0c04e620791aaf8f96a9e026c4ccd0cc69c13fd711a

    SHA512

    3553f13912fb041146c2d4b8ed4cc56957a140b632f7ad740293c0889d1cd9a7e6cbc7e2bae2d250e271c3c5a30cf248bd343293f3146a49eb6a0bdd4b5acded

    Download Submit

  • memory/456-773-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-744-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-776-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-743-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-777-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-740-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-196-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-194-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-748-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-749-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-750-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-751-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-752-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-753-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-754-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-778-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-768-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-769-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-770-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-771-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-772-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-134-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-774-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-775-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-742-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-741-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-767-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-779-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-780-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-793-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-795-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-796-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-797-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-798-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-799-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-800-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-801-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-802-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-803-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-804-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-805-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-819-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-820-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-821-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-822-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-823-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-824-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/456-825-0x0000000000150000-0x0000000000202000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1204-875-0x00000000005A0000-0x0000000000652000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1996-747-0x00000000005A0000-0x0000000000652000-memory.dmp

    Filesize

    712KB

    Download