Malware Analysis Report

2024-09-11 01:45

Sample ID 240411-xl1ypsdc9v
Target medusa.exe
SHA256 26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0
Tags
medusalocker evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0

Threat Level: Known bad

The file medusa.exe was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion ransomware spyware stealer trojan

UAC bypass

MedusaLocker

Medusalocker family

MedusaLocker payload

Renames multiple (233) files with added filename extension

Renames multiple (292) files with added filename extension

Deletes shadow copies

Reads user/profile data of web browsers

Executes dropped EXE

Drops desktop.ini file(s)

Checks whether UAC is enabled

Enumerates connected drives

Unsigned PE

Enumerates physical storage devices

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

System policy modification

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Modify Registry
T1112
Indicator Removal
T1070
File Deletion
T1070.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-11 18:57

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-11 18:57

Reported

2024-04-11 19:00

Platform

win7-20240221-en

Max time kernel

128s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Deletes shadow copies

ransomware

Renames multiple (292) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3787592910-3720486031-2929222812-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1300 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1300 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1300 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 2092 wrote to memory of 2188 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2092 wrote to memory of 2188 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2092 wrote to memory of 2188 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 2092 wrote to memory of 2188 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\medusa.exe

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\taskeng.exe

taskeng.exe {5AD3A7A4-3C05-49B6-80F6-3FD942B5EAD6} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

Network

N/A

Files

\Device\HarddiskVolume1\Boot\how_to_back_files.html

MD5 1654deeb91f6f675947f1e0a6e69eb21
SHA1 d610a58f43c62265c001435a70bb85efc120cf89
SHA256 11200a07041fb40da756abe604c1a0678d143f8da89d8348834b928a14344db6
SHA512 ef4af2c81762fd9e11870ea8b6b89ad68a6bb95a1861b8e7236880c6c5376bf700e00929dca87085a456cedbdef44a80dd6b6e09298385ae11748993c57bd6ea

C:\Users\Default\NTUSER.DAT.LOG2

MD5 503dcc2e8df380de64fbc34145012f3d
SHA1 18b5416757c765b453ca5af4dd8417f91adb8df5
SHA256 f03dd27002fc34819d38999955d809ac94e9cf42f47313385203495ae047ce9f
SHA512 2077448ff6b9eff3e82c92f89861b4d97e6b8d6c0c0fb346ddc5beba6c57d89f57839afc223c14de4dced29dc66f2e3326ef991d1d40853a255769ea8a2424a2

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 646698572afbbf24f50ec5681feb2db7
SHA1 70530bc23bad38e6aee66cbb2c2f58a96a18fb79
SHA256 26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0
SHA512 89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-11 18:57

Reported

2024-04-11 18:59

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Renames multiple (233) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1684 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1684 wrote to memory of 32 N/A C:\Users\Admin\AppData\Local\Temp\medusa.exe C:\Windows\SysWOW64\Wbem\wmic.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\medusa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\medusa.exe

"C:\Users\Admin\AppData\Local\Temp\medusa.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 109.116.69.13.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\how_to_back_files.html

MD5 7cbf795936b36f7abbe170922f710341
SHA1 95e248270b7dc9948902ade42198f4c03b29e5ad
SHA256 200cbe3a3903f0e108f29e30a20f1abe151399a11654f9d4a959a770d37e479b
SHA512 60ceeadfbb7a45a892034b09d60733da11eee1ddd20addac94ccc123fb98b125590b46b38b819329ab42b583bb2bc789bb117e27adf2ba1d337aa20d13c46a2e

C:\Users\Default\ntuser.dat.LOG2

MD5 6658f4baeaf85ed5344b282d043d41a1
SHA1 f75d627a1b8931f5755ba46bf3692063341413a6
SHA256 591dcb0e662cc217b3a43b54806ac0233b78e235b3473103578bd47629f569be
SHA512 f9725a1d1d5d9f538046953f7099c63a3cf11b830d534e27e0b45ee2aa66ec6cdc29d28d8a142bb24347dc4294b5639372586f92e1cc011781f2affd561741eb

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 646698572afbbf24f50ec5681feb2db7
SHA1 70530bc23bad38e6aee66cbb2c2f58a96a18fb79
SHA256 26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0
SHA512 89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a