Malware Analysis Report

2024-09-11 01:52

Sample ID 231130-mx5qxsah79
Target medusa.exe
SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
Tags
medusalocker evasion ransomware spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281

Threat Level: Known bad

The file medusa.exe was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion ransomware spyware stealer trojan upx

Medusalocker family

UAC bypass

MedusaLocker payload

MedusaLocker

Renames multiple (199) files with added filename extension

Deletes shadow copies

Renames multiple (192) files with added filename extension

Renames multiple (222) files with added filename extension

Renames multiple (281) files with added filename extension

UPX packed file

Reads user/profile data of web browsers

Executes dropped EXE

Enumerates connected drives

Checks whether UAC is enabled

Drops desktop.ini file(s)

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Interacts with shadow copies

Enumerates system info in registry

Opens file in notepad (likely ransom note)

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

System policy modification

Suspicious behavior: GetForegroundWindowSpam

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Modify Registry
T1112
Indicator Removal
T1070
File Deletion
T1070.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-11-30 10:51

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-30 10:51

Reported

2023-11-30 10:56

Platform

win7-20231020-en

Max time kernel

293s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Deletes shadow copies

ransomware

Renames multiple (281) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2084844033-2744876406-2053742436-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1392 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1392 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1392 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3024 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 3024 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 3024 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 3024 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\medusa.exe

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\taskeng.exe

taskeng.exe {32841301-DBDA-46F8-A0E8-890FD270301E} S-1-5-21-2084844033-2744876406-2053742436-1000:GGPVHMXR\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

Network

N/A

Files

memory/1392-0-0x0000000000130000-0x00000000001E2000-memory.dmp

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

MD5 cda5647b3e7d845925e1f9d60c101be1
SHA1 a9a9f5581194c533d2260420b921ef3a3c6acde3
SHA256 f19bcf6314627376b6846339f4b2b65755e98cafdeab010307a5d1b8125c31aa
SHA512 66000537677b94bbc6d5d74f7e3c871d567828c1dbc8c81d2bc91d5387708ee37f26c9caa961ea824ed33a04810be7e4a9f76a9f4b572759f138719088d58034

memory/1392-146-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-258-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-718-0x0000000000130000-0x00000000001E2000-memory.dmp

C:\Users\Default\NTUSER.DAT.LOG2

MD5 7980c2a3045f8c15d729e31dbde2446b
SHA1 f4a6c45c0cb637c7b9a33878ca26bf6c239539da
SHA256 bc65c7c079b40b64a5994302ce40fc2598172307c2f44ebb39ce52dd83dbea1d
SHA512 9d4c1780d514548e58f94a36684f8cf92b0adc2db2866e3df32d3c8e0975135216930c884c6e57a564a332edc5a710eddab323c3157c8adbdd9d0b6de7eee30f

memory/1392-869-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-870-0x0000000000130000-0x00000000001E2000-memory.dmp

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 f6f120d1262b88f79debb5d848ac7db9
SHA1 1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA512 1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 f6f120d1262b88f79debb5d848ac7db9
SHA1 1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA512 1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

memory/1976-873-0x0000000000180000-0x0000000000232000-memory.dmp

memory/1976-874-0x0000000000180000-0x0000000000232000-memory.dmp

memory/1392-877-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-878-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-879-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-881-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-882-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-895-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-896-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-897-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-898-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-899-0x0000000000130000-0x00000000001E2000-memory.dmp

memory/1392-900-0x0000000000130000-0x00000000001E2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-30 10:51

Reported

2023-11-30 10:56

Platform

win10-20231023-en

Max time kernel

284s

Max time network

262s

Command Line

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Deletes shadow copies

ransomware

Renames multiple (222) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-946614337-2046421199-3397417319-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2448 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2448 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2448 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\medusa.exe

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

Network

Country Destination Domain Proto
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp

Files

memory/2448-0-0x0000000000C40000-0x0000000000CF2000-memory.dmp

\Device\HarddiskVolume1\HOW_TO_RECOVER_DATA.html

MD5 7b2f1e43814a1439c7a48293f742b1af
SHA1 4ce0a0706a50f3a1a36ab7da4b9c04157e4dcde2
SHA256 c3b0d50112c1c52b0f712cee29137a7b5f340eb616a692f1fc2022f26cb83fdf
SHA512 731560b6755c77dbf4600df470af8dc250e2e36c7a5540581feb1acc86088ced27092c6409deaf74bfb28c7f878aba4d7094dd9d67716f59dd15339a84c4c3ff

memory/2448-222-0x0000000000C40000-0x0000000000CF2000-memory.dmp

C:\Users\Default\NTUSER.DAT.LOG2

MD5 dc1dd7d9b56ec109a0f10c300a6f4431
SHA1 836fe875899384298ae61a8aecc83e5de51a3234
SHA256 3a6c6e0d65944832b5dbffe2b2f6af87bb294f2e7062119c7d8421e0a537520a
SHA512 94a94169b0a65b4bf0b1b72b2a67bd15f97502d5685ccb297f7cd1085d1795d8dfb2112d61e201efe3686d1fe351bcf47b8b93bddb303c46281073d60a4c8582

memory/2448-691-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-692-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-693-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-694-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-695-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-696-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-697-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-698-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-699-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-700-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-701-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-702-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-715-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-716-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-717-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-718-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-719-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-720-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-721-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-722-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-723-0x0000000000C40000-0x0000000000CF2000-memory.dmp

memory/2448-724-0x0000000000C40000-0x0000000000CF2000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2023-11-30 10:51

Reported

2023-11-30 10:56

Platform

win10v2004-20231127-en

Max time kernel

281s

Max time network

246s

Command Line

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Renames multiple (192) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3455265224-196869244-2056873367-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000007b57a08b1100557365727300640009000400efbe874f77487e5780562e000000c70500000000010000000000000000003a0000000000ca39000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7e003100000000007e57885613004465736b746f7000680009000400efbe874fdb497e5788562e000000f90500000000010000000000000000003e0000000000c31613014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003900000016000000 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 7c003100000000007b57a28b11005075626c69630000660009000400efbe874fdb497e5780562e000000f80500000000010000000000000000003c00000000007fc328005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016000000 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\system32\NOTEPAD.EXE N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4860 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4860 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3880 wrote to memory of 4424 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 3880 wrote to memory of 4424 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 3856 wrote to memory of 1012 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 3856 wrote to memory of 1012 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\medusa.exe

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Acrobat Reader DC.lnk.marlock07

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Firefox.lnk.marlock07

Network

Country Destination Domain Proto
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

memory/4860-0-0x0000000000580000-0x0000000000632000-memory.dmp

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

MD5 f13cb978ef246b68849b84a0f0040f79
SHA1 39fa5109e02706b1414bb061189efa9598f25e30
SHA256 64f96198b3b23b69a5a718d484ffb0fefeaea1c0e98123f0313c1920c4627dbe
SHA512 a281e768aa080e3d319b16cd1e530280b87e75a51909d1383b953d19f5fcacc847a3612eb3b6baa0cc9780a6636cb9bfdb4c03de3b26a22b38c7b0c35fbf7856

memory/4860-174-0x0000000000580000-0x0000000000632000-memory.dmp

C:\Users\Default\ntuser.dat.LOG2

MD5 a666c53abf827032202dd665670778ac
SHA1 1230224f62cbd26aeba3a8ad9d73ac8cd0872390
SHA256 f14257579176812a53a38f08718edab717fc83ee08b55397af61047205554826
SHA512 11aa047a234db9a9cf15cff9def90cd4b0f1ce28e48e5e1731892f8a4d4f149e1487735d3695f5c2226ccc8f8dd33ac1e47a43825895ae00bc86051512c1bbfd

memory/4860-601-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-602-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-603-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-604-0x0000000000580000-0x0000000000632000-memory.dmp

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 f6f120d1262b88f79debb5d848ac7db9
SHA1 1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA512 1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 f6f120d1262b88f79debb5d848ac7db9
SHA1 1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA512 1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

memory/4732-608-0x0000000000450000-0x0000000000502000-memory.dmp

memory/4732-609-0x0000000000450000-0x0000000000502000-memory.dmp

memory/4860-610-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-611-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-612-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-613-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-614-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-615-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-616-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-629-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-630-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-631-0x0000000000580000-0x0000000000632000-memory.dmp

C:\Users\Public\Desktop\Acrobat Reader DC.lnk.marlock07

MD5 3b6babe2a37ca43cc9efd477392ca853
SHA1 dd597c541192afb3709df2e732a25b5acffb67e9
SHA256 03884381b2b4753cb5ee70ec13fd1c203b96816d716560c44c88e0f0ef976d37
SHA512 98dff415981cc0047947cf54c5998bfb932904cff7b9bd8d52b2deac7a9c90df6f199b580dd2f94f9c83c2efa8b253877403f08a6dd56ef100900103f7945485

memory/4860-633-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-634-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-635-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-637-0x0000000000580000-0x0000000000632000-memory.dmp

memory/4860-639-0x0000000000580000-0x0000000000632000-memory.dmp

C:\Users\Public\Desktop\Firefox.lnk.marlock07

MD5 9e822b9d5a12fc6b095f8e098a4479d0
SHA1 c5823bac0ddeecddc6ec53529da2137fd71ee7b2
SHA256 8e759cbf969d6d6ecb550c917c378bcfe00613eae16b324930b1a397872eeda5
SHA512 74dc7f0e94758b9a43cd122306de7b291768cf01e218101584a5940ddb8e4a2e3ddcaa28bd5860d191a7605b7929af89467657801c82592b58b15c51166dec06

memory/4860-641-0x0000000000580000-0x0000000000632000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2023-11-30 10:51

Reported

2023-11-30 10:55

Platform

win11-20231128-en

Max time kernel

181s

Max time network

189s

Command Line

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Renames multiple (199) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3484251756-2814966285-185304317-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133458151786489025" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4372 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 4372 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2044 wrote to memory of 1036 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 5780 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 5780 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1036 wrote to memory of 556 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\medusa.exe

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1036.0.395363577\1952191459" -parentBuildID 20221007134813 -prefsHandle 1824 -prefMapHandle 1816 -prefsLen 20806 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91076471-b3df-478e-8419-5bf6600e1c70} 1036 "\\.\pipe\gecko-crash-server-pipe.1036" 1904 1d09e2edd58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1036.1.964590804\1311873936" -parentBuildID 20221007134813 -prefsHandle 2268 -prefMapHandle 2264 -prefsLen 20842 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1107555d-a885-45f1-968a-683c8e1f09ab} 1036 "\\.\pipe\gecko-crash-server-pipe.1036" 2288 1d09e1fde58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1036.2.951707978\625177218" -childID 1 -isForBrowser -prefsHandle 3048 -prefMapHandle 3052 -prefsLen 21660 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {004b0e90-73b9-4dbc-b7bd-b813e2226fac} 1036 "\\.\pipe\gecko-crash-server-pipe.1036" 3064 1d0a2351758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1036.3.273502383\1245654946" -childID 2 -isForBrowser -prefsHandle 3500 -prefMapHandle 3496 -prefsLen 21766 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d89ad9f-9426-4129-8584-84e19918485d} 1036 "\\.\pipe\gecko-crash-server-pipe.1036" 3380 1d0a2f6a758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1036.4.250515744\1120266382" -childID 3 -isForBrowser -prefsHandle 3508 -prefMapHandle 3512 -prefsLen 21766 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6171fc7f-af4e-4e3d-be32-a1fb0f38a2bd} 1036 "\\.\pipe\gecko-crash-server-pipe.1036" 2916 1d0a2f6b958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1036.5.652860755\2033631756" -childID 4 -isForBrowser -prefsHandle 3700 -prefMapHandle 3704 -prefsLen 21766 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {047f65e8-7ec8-4c99-9819-9b9af0e0e511} 1036 "\\.\pipe\gecko-crash-server-pipe.1036" 3688 1d0a33eda58 tab

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff93cae9758,0x7ff93cae9768,0x7ff93cae9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4684 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4504 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5160 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5680 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3472 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5344 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:1

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe

"C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe" -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=880 --field-trial-handle=1800,i,16823939531161408540,4424338954340834574,131072 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 126.21.238.8.in-addr.arpa udp
N/A 127.0.0.1:50370 tcp
N/A 127.0.0.1:50372 tcp
US 131.253.33.200:443 www.bing.com tcp
NL 88.221.24.104:443 r.bing.com tcp
NL 88.221.24.104:443 r.bing.com tcp
NL 88.221.24.104:443 r.bing.com tcp
NL 88.221.24.104:443 r.bing.com tcp
NL 88.221.24.104:443 r.bing.com tcp
NL 88.221.24.104:443 r.bing.com tcp
US 20.42.65.89:443 browser.pipe.aria.microsoft.com tcp
NL 142.250.179.206:443 ogs.google.com tcp
DE 172.217.23.195:443 ssl.gstatic.com tcp
NL 142.251.36.46:443 clients2.google.com udp
NL 142.251.36.46:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
NL 142.251.39.106:443 translate.googleapis.com tcp
US 192.178.49.195:443 beacons.gcp.gvt2.com tcp

Files

memory/4372-0-0x0000000000600000-0x00000000006B2000-memory.dmp

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

MD5 7c882eb47ce467cebb35d025e0bdd9c7
SHA1 1cb4fc9ebd1c27d9893c794f15fe30e76647c8bf
SHA256 40034a55fe9884c08eccf8febd1e346dbb3458b17a0d5facb86426c4ce48f504
SHA512 3f5569414b809427849dd05ba61b7110213d5ff611b35eaa894c13995cdf6b0a843763e72f4a5b0b59abe20ca4157d314e67535dd16d88c5ad897788683d9436

memory/4372-309-0x0000000000600000-0x00000000006B2000-memory.dmp

C:\Users\Default\ntuser.dat.LOG2

MD5 3ed20df13367877eb8a955cdcdc1a42e
SHA1 36d220bc611e314278894048db71ff528c6ba1e5
SHA256 605d46567112f21cdeb704cc11f18cd94f48ff05b9c1f49a2b08b76fbd5b515b
SHA512 7b6146d9e7f16d3f76d828cc4986fe49c604b463e1d9f31838f24b29c9920b4ed3b5f489144a06d927058e81126fcb153c12ba9766d59307ce64320fe9a63214

memory/4372-622-0x0000000000600000-0x00000000006B2000-memory.dmp

memory/4372-623-0x0000000000600000-0x00000000006B2000-memory.dmp

memory/4372-631-0x0000000000600000-0x00000000006B2000-memory.dmp

memory/4372-632-0x0000000000600000-0x00000000006B2000-memory.dmp

\??\pipe\crashpad_1840_DMDSKJOLNOHYPQUF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4372-662-0x0000000000600000-0x00000000006B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zpmtdrel.default-release\sessionstore-backups\recovery.jsonlz4

MD5 534026b66496114919ee0d43704e62a7
SHA1 fc46cc6753b5a9bddf4bbe54bb2e97851eb13f01
SHA256 058438ec937c749043e6d72819d105de8bccd68e57413d73689b04ae83c3553a
SHA512 e06f9031142522b0ed4249b7210a6f4d17b77132adb1ce4ce3ad62fc3b1c32f8e2a7a0f77526e75ee80603597beb1790ae11130182ebd518a3ecc2ecf91027c7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 f6f120d1262b88f79debb5d848ac7db9
SHA1 1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA512 1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 f6f120d1262b88f79debb5d848ac7db9
SHA1 1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
SHA512 1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6c71fdd73ea1ad48072ea3b04653e983
SHA1 42561fb89d9de80cb79e5f095d612ca8a71c0366
SHA256 104a5fdcb7b1b559cf4ea77bfdab0ed2b070e3493abf4ad87017fca6de443c12
SHA512 e4534ab5144b81456eb14ac94086ec5a51fd7bc440a16764f0ad4200ba6404dd3d159e2e63405da7f31444fbff3ed7a1428443b1507977848d7f5f04fbb633cd

memory/588-675-0x00000000005F0000-0x00000000006A2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 02f390d4cfa9387f0e5ccf87854d590a
SHA1 85a9ab430e6062fa249e1b81b80fa3093b445050
SHA256 0ce8cfb34678faa782dc0c8253f6ba0e6855d21d01c9680e94cec33bbea64e5f
SHA512 c501b612e529b5e877a43dc9225b5d0da9109d016d068ea8f686bc502429d3130abd8bef03c058bbc60346f2599223654076bb7936fe7f56cb583ab3f93af263

memory/588-687-0x00000000005F0000-0x00000000006A2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 6f0277cfa545f5e302113e5580a57bdb
SHA1 76ba4a8a5e6a5b4e3d1f53741914e2e8199e081f
SHA256 7e733907b3841c4cfa9737095b8a1be8a9a4e809aaa5583a02e7592256c3edab
SHA512 0e3dbb52b2c632fe0fc5839f69d8c4bda78ff6f1d3f11807c2e4b5b48ef0902780886c8fb5bebd2e20f37e443a0a24a81c45d2643f5c7cfd398a3a8825e56847

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 fa7fae8dc945b378302582f7776db220
SHA1 0399a0d6e46bb1796a702264dd8df6639089307a
SHA256 120bc047c87bd2458eae7eeed97858045d217250e64125aa12984c57b62d34ce
SHA512 160ee72f32e78294c06939209663112030288c39304273b2907716a3e2de67916dd8dd020509ce977f7ff887499d6cd25444fa47114a7c555a3185b1409d058b

memory/4372-741-0x0000000000600000-0x00000000006B2000-memory.dmp

memory/4372-755-0x0000000000600000-0x00000000006B2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ca41be183fc5d3b976435f4fe2fbc124
SHA1 e677eb7c62793b4fdfc1cdad279439ca8241c470
SHA256 b4aeae1ad79d419887b4edb420603001c6e05204941e48b477b0420e8003339f
SHA512 ae8012cb7e8a115560252b4452960140735f3d6ac4ea8340d1dab6040cb2493394db8709b0bc0043b8efb2ce8e633b6e1b01deab4e632b2dc4aead2304a743f0

memory/4372-767-0x0000000000600000-0x00000000006B2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 128eae7ebf50aa203bd865697de70285
SHA1 335017db3bb911d42da88b6e332339e2e688e5c2
SHA256 765a98adc298e6874883ea76487c48ce3a4088f2134eb7fd530ededbaabfd129
SHA512 de9045d27f6ec9a56e5dfd744879627f5ad09ea479b4cd8906f3c2f55646d000f04dcfba057802ffe45113812d69a7bec56d57dae8c1f17b7f1359a572bb6e92

memory/4372-781-0x0000000000600000-0x00000000006B2000-memory.dmp

memory/4372-784-0x0000000000600000-0x00000000006B2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 9a0e7e03f3d9e1a9a49121fb4031e479
SHA1 59443f4b5aafaa21fbf327854d7cc7d9a5a17415
SHA256 eba839922c2bf4426a8435119db8e42b3a0826b67d27a64855d1f3492e958f92
SHA512 bab2167f739cf31c32f9803687a4051089b4e27b97881090452450051032d60209c67d8497d5680fa4cd15c6f01e5050e25c94ad83a5b88d00e6d44cd3374395

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 985e754176165eace81b997674c290d9
SHA1 6ba161a2d729c2b594bb32e777d8fc6505b5b541
SHA256 d08bfd3dbf0564c9055a074a69ed7a2c54320d0523f1fc958a97066bac169ffe
SHA512 10ad3d0d201f7021867a7fb7ab4cbaa38f72b3ffe54bd6c1c6a15dc5596fd2f2427764dcd84597f747e576e22cde662a6294e9b473c328c5635e1f2c75a755aa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 d86d99d97baacf5fb2d1faa70ec39cf0
SHA1 0471e8f50611056a00b0735175eeb351f85deac4
SHA256 cf2ddf969bd94d800a015a6c7ef9c0873c1f882c81a4c64b732fef2c97c92029
SHA512 6df86199d35b526e9f54f0a19e0a7249ae0cfacddfc0649a24bfad854f7c5b71cf9b14c24824e449cbce35e5e1518bdba8a6ea823091f45f2c617a83a94eaae5

memory/4372-811-0x0000000000600000-0x00000000006B2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59b905.TMP

MD5 f630f0f6d6f4c19071c28fbf6ea17c9c
SHA1 4fe04e8c1d15fcbc6edd1c47bb83dac55c5bc074
SHA256 b1c2fa1c443a350d7e2bdcb0c4fdf31f61dfe1622a4c4e17472bb8316010ca89
SHA512 aef89e88a956798880b0db2f8309f6554b34bf5e994ae91143826139c6d43addb5e08509aed4e64ebfd5883260116f1c3dac79aa9dadbc4cca909975adb7e743

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 b1c38ed17b14a071cd9b7a3b17c077a7
SHA1 77d208b99cffe25351c36e86bc5600417af9c12b
SHA256 a3e5e53d2ca0f50f0fd72c602d8415d9c493a471e5e338444cec4f1293c09dba
SHA512 8b85e7002bf375f23d2e38896d26a63f2dd01dcba5e86ebfcbb29c678e13c337dbb0bfeac4ca0b29ac2de70a548b715c5564a7aedd5d2d8abbfa3a2444abffcb