Overview

overview

10

Static

static

10

medusa.exe

windows7-x64

10

medusa.exe

windows10-1703-x64

10

medusa.exe

windows10-2004-x64

10

medusa.exe

windows11-21h2-x64

10

Resubmissions

30-11-2023 10:51

231130-mx5qxsah79 10

29-06-2023 20:59

230629-zs72psfa95 10

29-06-2023 16:29

230629-tzp7ksec27 10

Analysis

  • max time kernel
    281s
  • max time network
    246s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2023 10:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    medusa.exe

  • Size

    235KB

  • MD5

    f6f120d1262b88f79debb5d848ac7db9

  • SHA1

    1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

  • SHA256

    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

  • SHA512

    1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

  • SSDEEP

    6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e

Score
10/10
medusalockerevasionransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">F09A2668849B835134F26ED3E1F0A99CB3B2C1333E9A2D59872EF190839AEA80EE6E3A4B50939EECE855AA917D98C97E438B785D15F6FB11473C09F44A5698C2<br>2BC5615708099C64CAABABE678187D23A9434A0E62AE708821A90A650E4A64FF76B00B6C9F11BAD12E77A16FAA54F24EE541B9F05FF52378EA4A9AF5D9EF<br>7A0AF1354917B37290702ECEF848A6CB9E4FC9B4DFCB00E2792DD1AFBFFBA3740B52376033B2E064430E9D2CB1B5C0CD2C4C2D3D889A6D287567C18AD801<br>4E9450DEAD4AA4B0B194251C1483F0A822B3BB62281489B3D38913C667FA6120548AE07B9DD09D5FFC98372D06E2B4DAC6A1D4F2A20E696DBB7E1369E794<br>0B51541536241BF6E63959A086E738C6183B658CEF2B983FD03F449CB156242A9A2847AE3EA14347F6606E7387E125339887359D41B4373690E3E24758D1<br>81EA39DFEB09EF27A13DA4B4C2DA2448E3009A80553F7B53BB2B2B4FCC94A1A2410439B5754ACC0CDF510979ECDBEEE0FC7B2A29C90BE03B9A09FAAED80D<br>7F5E7F585B6B26A430EBBEA977C373E00DBE92502634896896A8A4139ADA133DC5EBB53E297B1DE8BAE17D29CD828AD262DDB00D537E37F761B53405A8E7<br>A26A63206BA5B1B6609A7494866F716CBDE7E0540E232F144236C611B685707024D3EDFC62A5729A793ABBA9BE9D11AE66FFB83CCA7279562D3638B3598F<br>1BEEA7DE87D490101979E817753E</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 22 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Renames multiple (192) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 45 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\medusa.exe
    "C:\Users\Admin\AppData\Local\Temp\medusa.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4860
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2492
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1652
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4372
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    PID:4732
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5028
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3880
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Acrobat Reader DC.lnk.marlock07
      2⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4424
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Firefox.lnk.marlock07
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    235KB

    MD5

    f6f120d1262b88f79debb5d848ac7db9

    SHA1

    1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

    SHA256

    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    SHA512

    1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

    Download Submit

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    235KB

    MD5

    f6f120d1262b88f79debb5d848ac7db9

    SHA1

    1339282f9b2d2a41326daf3cf284ec2ae8f0f93c

    SHA256

    1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

    SHA512

    1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

    Download Submit

  • C:\Users\Default\ntuser.dat.LOG2
    Filesize

    536B

    MD5

    a666c53abf827032202dd665670778ac

    SHA1

    1230224f62cbd26aeba3a8ad9d73ac8cd0872390

    SHA256

    f14257579176812a53a38f08718edab717fc83ee08b55397af61047205554826

    SHA512

    11aa047a234db9a9cf15cff9def90cd4b0f1ce28e48e5e1731892f8a4d4f149e1487735d3695f5c2226ccc8f8dd33ac1e47a43825895ae00bc86051512c1bbfd

    Download Submit

  • C:\Users\Public\Desktop\Acrobat Reader DC.lnk.marlock07
    Filesize

    8KB

    MD5

    3b6babe2a37ca43cc9efd477392ca853

    SHA1

    dd597c541192afb3709df2e732a25b5acffb67e9

    SHA256

    03884381b2b4753cb5ee70ec13fd1c203b96816d716560c44c88e0f0ef976d37

    SHA512

    98dff415981cc0047947cf54c5998bfb932904cff7b9bd8d52b2deac7a9c90df6f199b580dd2f94f9c83c2efa8b253877403f08a6dd56ef100900103f7945485

    Download Submit

  • C:\Users\Public\Desktop\Firefox.lnk.marlock07
    Filesize

    8KB

    MD5

    9e822b9d5a12fc6b095f8e098a4479d0

    SHA1

    c5823bac0ddeecddc6ec53529da2137fd71ee7b2

    SHA256

    8e759cbf969d6d6ecb550c917c378bcfe00613eae16b324930b1a397872eeda5

    SHA512

    74dc7f0e94758b9a43cd122306de7b291768cf01e218101584a5940ddb8e4a2e3ddcaa28bd5860d191a7605b7929af89467657801c82592b58b15c51166dec06

    Download Submit

  • \Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
    Filesize

    4KB

    MD5

    f13cb978ef246b68849b84a0f0040f79

    SHA1

    39fa5109e02706b1414bb061189efa9598f25e30

    SHA256

    64f96198b3b23b69a5a718d484ffb0fefeaea1c0e98123f0313c1920c4627dbe

    SHA512

    a281e768aa080e3d319b16cd1e530280b87e75a51909d1383b953d19f5fcacc847a3612eb3b6baa0cc9780a6636cb9bfdb4c03de3b26a22b38c7b0c35fbf7856

    Download Submit

  • memory/4732-609-0x0000000000450000-0x0000000000502000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4732-608-0x0000000000450000-0x0000000000502000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-612-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-629-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-603-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-602-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-610-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-611-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-0-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-613-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-614-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-615-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-616-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-604-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-630-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-631-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-601-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-633-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-634-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-635-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-637-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-639-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-174-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download

  • memory/4860-641-0x0000000000580000-0x0000000000632000-memory.dmp

    Filesize

    712KB

    Download