Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29-05-2024 14:17
General
-
Target
4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36.exe
-
Size
535KB
-
MD5
d17dcd3b8f0bd0ae5eee86b39c4232c5
-
SHA1
8d9ed7444aabf5df4e4066c707358e03c9a38cf8
-
SHA256
4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36
-
SHA512
e5bba3470615b5f854209ce8d7fbea534cc6092d7f1ed1eef32c570aeef118467e1dd1772e8a8cab4507c7088fe4ca798d086189464f51086e05255e87fce22f
-
SSDEEP
12288:z/JPISLQOyNXK9ayXmhUcVbbwKylMV+rGLvbOHxGz:z78fN6YrbtbJHVsG1z
Score
10/10
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 4 IoCs
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36.exe"C:\Users\Admin\AppData\Local\Temp\4be825ffefde03c6614e5799f7e489084e03620eb383f91624a7d24f63adfa36.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 5722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 6162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2364 -ip 23641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2364 -ip 23641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
-
Filesize
244KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
252KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
8KB
-
Filesize
472KB
-
Filesize
244KB
-
Filesize
252KB