Overview

overview

10

Static

static

10

45de70c85e...f4.exe

windows7-x64

10

45de70c85e...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45de70c85ece8763c685808eea085df4

  • Size

    669KB

  • Sample

    240106-lb4q3acdhk

  • MD5

    45de70c85ece8763c685808eea085df4

  • SHA1

    c9dd5313a661fd17b154ccb17a36e8399fc933a5

  • SHA256

    d595339cbbf415eca195eb3a0d9a8b6c9ff82a0cf36e4e867f5cef24503bb532

  • SHA512

    03a1d922711db1afc0a512151371c9a97a7478578c11591109537b1427aeac8b3ac44aa52c83439afe56e20134fd888bcaee1632f6046ce8edf0d99622fb362d

  • SSDEEP

    12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DNKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWgKrKe

Score
10/10
medusalockerevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">5FC33CDBB993EB8840E5CB64D4AA189A72787367174C189E6501CCD51930E09BA47664C9C0F6BE5B2DB640FD0200C79BF877D1080BCCE6D8CE4E649AD59079F0<br>A38BAFD4281F65DF3E64D839F2ABD806B1A57AE769860E25761CBC5BA225F1E6BCC948A3AA910CD323590D36B43F0751FEDC5ED406E5A68196F95021B3BA<br>C502BCE6F994B5B36260C2DC4F9C327FC9B938322B26B29CCD42A26423395F911F420820571BCAD5FAA5A081AAFB08D17ED5AE0E7FF873676E5E33F67369<br>66C63903B210DED1EF6CC68C1FD8292D326A400CCCF6AF7B1C9D540B1F49E9AF7AEF935B18A9F5A06081BD297F9D0B0B07F85D1700389163064C59A20E10<br>BDDDBB1071648A04360D6EAB77CDB4482B3088AA3C82AF8FF9F18F3CE1954BEC74FB49A2583FC41463F25A47664BED6E819FC1785F369CBE0FD9332570CA<br>9A1D0DCE97F58C11286B97DF18C6DDD645A4E9C7195522115A00922BC11F33242249463321418E19CA454129ABDA35E2B705328D391DE6662BCFD5033C51<br>82F82346AA9CD652036426F47BFA33BC38E0FA4C066BAA3833F3147158BB54FF5DAE3069EEEAED6D6F78DAAC2CB2E819C7287FC16A21242B637C7BA0A175<br>788CFE5BBD5AC694954A9991EA9C48B2BB311D15C73652E5E5906495C23D3B49AECB80DB0F286C7928EC3B48DDCD74123278DE3635641CF523594993975D<br>FDC7BE5A5D67407F4A52D46E6509</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target

      45de70c85ece8763c685808eea085df4

    • Size

      669KB

    • MD5

      45de70c85ece8763c685808eea085df4

    • SHA1

      c9dd5313a661fd17b154ccb17a36e8399fc933a5

    • SHA256

      d595339cbbf415eca195eb3a0d9a8b6c9ff82a0cf36e4e867f5cef24503bb532

    • SHA512

      03a1d922711db1afc0a512151371c9a97a7478578c11591109537b1427aeac8b3ac44aa52c83439afe56e20134fd888bcaee1632f6046ce8edf0d99622fb362d

    • SSDEEP

      12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DNKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWgKrKe

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojan

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (299) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks