Overview

overview

10

Static

static

10

4ef811b784...24.exe

windows7-x64

10

4ef811b784...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ef811b784b985769645e03bc0b9cd24

  • Size

    669KB

  • Sample

    240109-xrn64aaae6

  • MD5

    4ef811b784b985769645e03bc0b9cd24

  • SHA1

    2e04a37b215dd2a95694b1c18dbe1dd35be5aa9f

  • SHA256

    4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c

  • SHA512

    34e9a5a015b04ae904b50a0b2e466788db16d7eb43769fec156cab830932032174b3a43a206016332f99eb16571225dc1a0a0042ce2bca67de1821bbc08c039c

  • SSDEEP

    12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DBKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWUKrKe

Score
10/10
medusalockerevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">4CB884E686C4A903E35C87018D2AD8E56D647C4CEDAE3224B8933CF79437DDCCCDFC6CFE8ED6F5721F6C949394A6877C9F5DE74088C4199804C6B233C9AF7ED3<br>5A330BAD8D5E2D6041B3781968F3AA92CFAC63DDA2A0F8DB1F5A1CE8F31E281181EE9396AC86E3CE9C596DD643344A355E22BD6ACCB03514D6DBA924266A<br>55C83017BFF40EBEBDB6253322C90085EF7A77CD31FE4EC46E9B952E8227AE34ED729C79A87D7D5673DD7070EA237FC9379F9E8EE46FE9FECA7BC665CE65<br>D147F803537D3D715649E127E67FE233A9FAC1175B7CDACE862C0A01B348002144B2E8F065D367682CD67424ED74E6C7555552F387ED392C432FC7066250<br>80BC9448A949D680EC77404481842B2FEAB75C7469004B816CAFB6976F46F0767CE599997E60216F1897B93E5E7B29D3425232FD6223D2B32272528AA799<br>8BDC052CB4079485FD0135AE911C8AF534A75C9C004468DC04BBA9C5DC4DC387BE7EB238A8523F21D3B9C59DD9F81675B5CE6595AE83A2D3AEDC62F7936B<br>C29F98E319771F5F4C9C085241524B326D1C3FD16E7521DD2904C5A8BBD2468693FBABEB2B1DD903426DCC3AA4C118E34967B24F36969A007615BAF39AE7<br>E8BCD0C675989CBFE73342637829DF5CA6C0BCC75C2D911AAAEA21EADBC6CB1A506AFE7779143950374941803C728710890E6294A9FA0CD6A62DE25C870B<br>8A7216F13F8FFBE86CCE6B5C224C</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target

      4ef811b784b985769645e03bc0b9cd24

    • Size

      669KB

    • MD5

      4ef811b784b985769645e03bc0b9cd24

    • SHA1

      2e04a37b215dd2a95694b1c18dbe1dd35be5aa9f

    • SHA256

      4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c

    • SHA512

      34e9a5a015b04ae904b50a0b2e466788db16d7eb43769fec156cab830932032174b3a43a206016332f99eb16571225dc1a0a0042ce2bca67de1821bbc08c039c

    • SSDEEP

      12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DBKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWUKrKe

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojan

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (283) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks