medusalocker | 9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7 | Triage

Sharing

General

Target

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.sample
Size

277KB
Sample

240227-wea82afd93
MD5

d037f5c167b01849d267696695a919ef
SHA1

457ae227d1b63f295afbe18b539ff3b258f44a32
SHA256

9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7
SHA512

dcfb23c34be7688c292376c605b38eab3087fccd42b3dcd1708062dfee63e972c01107db505c90dc4db2f982bb5ea54fe2f9df9227e87b996a0346d0ea4c9a21
SSDEEP

6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdwNN4:6l4qnM6c26s39jNN4

Score

10^/10

medusalocker

Malware Config

Targets

- Target
  
  9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7.sample
- Size
  
  277KB
- MD5
  
  d037f5c167b01849d267696695a919ef
- SHA1
  
  457ae227d1b63f295afbe18b539ff3b258f44a32
- SHA256
  
  9c5c1dc70479d5839604a61f5849dee0fc09075d220c07e28343fa6d49cdb7d7
- SHA512
  
  dcfb23c34be7688c292376c605b38eab3087fccd42b3dcd1708062dfee63e972c01107db505c90dc4db2f982bb5ea54fe2f9df9227e87b996a0346d0ea4c9a21
- SSDEEP
  
  6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdwNN4:6l4qnM6c26s39jNN4
Score

10^/10
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2