Malware Analysis Report

2024-09-11 01:46

Sample ID 240703-jq1lvatdlf
Target 2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker
SHA256 6112da76e670a9c450c3f55c1bcafe22ddd199983470ab8d7e24c03688524387
Tags
medusalocker defense_evasion evasion execution impact persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6112da76e670a9c450c3f55c1bcafe22ddd199983470ab8d7e24c03688524387

Threat Level: Known bad

The file 2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker was found to be: Known bad.

Malicious Activity Summary

medusalocker defense_evasion evasion execution impact persistence ransomware spyware stealer

MedusaLocker payload

Medusalocker family

Deletes shadow copies

Renames multiple (880) files with added filename extension

Modifies boot configuration data using bcdedit

Renames multiple (749) files with added filename extension

Drops file in Drivers directory

Deletes System State backups

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Drops desktop.ini file(s)

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System policy modification

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Windows Management Instrumentation
T1047
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Direct Volume Access
T1006
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-03 07:53

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-03 07:53

Reported

2024-07-03 07:55

Platform

win7-20240611-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe"

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (880) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\protocol C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe\" e" C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\vssadmin.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\DEFAULT C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SAM C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SECURITY C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\LogFiles\Scm\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\eafedb3c-c868-4fe5-9757-b0254668c1e8.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\config\RegBack\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\SOFTWARE C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\RegBack\SYSTEM C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\SECURITY C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\d50b8534-f426-4a50-adec-dee5a45f8581 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\d50b8534-f426-4a50-adec-dee5a45f8581.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\92a94b45-b265-4bf2-9b75-56073ed8734f.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\d50b8534-f426-4a50-adec-dee5a45f8581.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\eafedb3c-c868-4fe5-9757-b0254668c1e8 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\release C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chihuahua C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Riga C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guatemala.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Noronha.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Niue C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Adak.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sitka.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Java\jre7\lib\security\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UCT C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tirane C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\meta-index C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Detroit.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Maceio.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Miquelon.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Martinique C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th1 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Boot\DVD\EFI\BCD C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th1 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_3 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File created C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Boot\PCAT\bootmgr C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th0 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb1 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th2 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb0 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb2 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_2 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\dewindow C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb2 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb1 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_1 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Panther\setupinfo C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th0 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb0 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\ehome\CreateDisc\Components\tables\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th2 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\enwindow C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_1 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_2 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_0 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_0 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Boot\DVD\PCAT\BCD C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\vssadmin.exe
PID 2784 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\bcdedit.exe
PID 2784 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\wbadmin.exe
PID 2784 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\System32\Wbem\wmic.exe
PID 2784 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\System32\Wbem\wmic.exe
PID 2784 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\System32\Wbem\wmic.exe
PID 2784 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\cmd.exe
PID 2784 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\cmd.exe
PID 2784 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe"

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB

C:\Windows\system32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled No

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE >> NUL

Network

N/A

Files

C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\!!!HOW_TO_DECRYPT!!!.mht

MD5 fd2aa82dbc6fb17cde7e2883aa1354a4
SHA1 d56caa868c84ce19bf5af4d200adefc265a69a78
SHA256 9399bbc8de92fb02e47153d4dc2f8bab4ab124a1c52ef9b04d6f0f36f1880082
SHA512 7b18b3702064d48334206e071645419aa3fd03f3ddce5511d4e7675e7653f411c7740317df67edbe18886a43fd57c2c00aae66c8753a2747807de795a5e4e1a5

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-03 07:53

Reported

2024-07-03 07:55

Platform

win10v2004-20240611-en

Max time kernel

144s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe"

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Renames multiple (749) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\wbadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\wbadmin.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\networks C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\services C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe\" e" C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\F: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\G: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\D: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\E: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\E: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\D: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\G: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened (read-only) \??\F: C:\Windows\SYSTEM32\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SYSTEM32\vssadmin.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\7485bac9-156d-46ab-8e91-c10ca39002fd C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\7485bac9-156d-46ab-8e91-c10ca39002fd.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\ResPriImageList C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\ELAM.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\system32\CatRoot2\edb.jcp C:\Windows\system32\svchost.exe N/A
File created C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\3f42b81d-bf73-4ef0-8b1e-915b3e317300.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\SECURITY C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\system32\CatRoot2\edbtmp.log C:\Windows\system32\svchost.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\BCD-Template C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\system32\CatRoot2\edb.jtx C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\system32\CatRoot2\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\ELAM.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\system32\CatRoot2\edbres00001.jrs C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\SYSTEM C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\4a91521f-933f-424a-8c3d-fc49092462bc.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\7485bac9-156d-46ab-8e91-c10ca39002fd.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\ResPriHMImageListLowCost C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\system32\CatRoot2\edbtmp.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\4a91521f-933f-424a-8c3d-fc49092462bc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\COMPONENTS.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\3f42b81d-bf73-4ef0-8b1e-915b3e317300 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\MsEdgeCrashpad\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Google\Chrome\Application\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\MsEdgeCrashpad\metadata.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Mozilla Firefox\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\MsEdgeCrashpad\metadata C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\removed-files C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\precomplete.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\AppReadiness\S-1-5-21-3665033694-1447845302-680750983-1000 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_0c2dbd8b-df2c-459b-9e3f-15002e1e55b7.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52 C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Panther\setupinfo C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{E634F316-BEB6-4FB3-A612-F7102F576165} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\SYSTEM32\wbadmin.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{B175520C-86A2-35A7-8619-86DC379688B9}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{2BB73336-4F69-4141-9797-E9BD6FE3980A}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{79043ED0-7ED1-4227-A5E5-04C5594D21F7}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9F51D16B-42E8-4A4A-8228-75045541A2AE} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{79043ED0-7ED1-4227-A5E5-04C5594D21F7} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\AppReadiness\S-1-5-21-3665033694-1447845302-680750983-1000.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Panther\setupinfo.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9F51D16B-42E8-4A4A-8228-75045541A2AE}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{01B2627D-8443-41C0-97F0-9F72AC2FD6A0} C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{2BB73336-4F69-4141-9797-E9BD6FE3980A}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.1btc C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
File opened for modification C:\Windows\Installer\SourceHash{9F51D16B-42E8-4A4A-8228-75045541A2AE}.inprocess C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3848 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3848 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 3848 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 3848 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 3848 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\bcdedit.exe
PID 3848 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 3848 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 3848 wrote to memory of 300 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 3848 wrote to memory of 300 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\SYSTEM32\wbadmin.exe
PID 3848 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\System32\Wbem\wmic.exe
PID 3848 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\System32\Wbem\wmic.exe
PID 3848 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\cmd.exe
PID 3848 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe C:\Windows\system32\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe

"C:\Users\Admin\AppData\Local\Temp\2024-07-03_728cb2fb25ddc3b86db2e1f72cf48dd3_medusalocker.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled No

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SYSTEM32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\da-DK\!!!HOW_TO_DECRYPT!!!.mht

MD5 92584b6066f5807eeaa4161445263a37
SHA1 15f954d1962c25fb517d1a3c851d4311d4b51ec3
SHA256 a42756667286ee85880ec7d1e83ad20c26d79a80bd1379e557ce1ec53af6f707
SHA512 5c604feceeb4136392145ef180cb8549e748c552e6ab672a7aab219a74a21c57c9e015fb842c2206370e0c6ef8da2f32073efbe70f4ee9df714be02e1ba1ff2c

memory/2160-871-0x000001D3B7F90000-0x000001D3B7FA0000-memory.dmp

memory/2160-877-0x000001D3B8740000-0x000001D3B8750000-memory.dmp

memory/2160-886-0x000001D3BCA40000-0x000001D3BCA41000-memory.dmp

memory/2160-894-0x000001D3BC820000-0x000001D3BC821000-memory.dmp

C:\Windows\System32\catroot2\edb.log

MD5 50b6087229fa8fb28c5292f0bdf89cc3
SHA1 50dd6d623e2ae98b237f9db5989badf5a019018a
SHA256 043dfd802b665f0bf70e529466c989ce64d4ec15276623c658a65ced433ddb80
SHA512 5b9e10ee9e1ebf115dafe435789695b7b48bfb192f085efe63cb91c2a861441515787ca4d9d680dcabd552e686f2051f8702b011dde063519c3b3caeb7331edb

memory/2160-916-0x000001D3BCAE0000-0x000001D3BCAE1000-memory.dmp

memory/2160-918-0x000001D3BCAE0000-0x000001D3BCAE1000-memory.dmp

memory/2160-919-0x000001D3BCC20000-0x000001D3BCC21000-memory.dmp

memory/2160-920-0x000001D3BCC40000-0x000001D3BCC41000-memory.dmp

memory/2160-923-0x000001D3BCD20000-0x000001D3BCD21000-memory.dmp

memory/2160-925-0x000001D3BCD20000-0x000001D3BCD21000-memory.dmp

memory/2160-926-0x000001D3BCE50000-0x000001D3BCE51000-memory.dmp

memory/2160-927-0x000001D3BCE70000-0x000001D3BCE71000-memory.dmp

C:\Windows\System32\catroot2\dberr.txt

MD5 c86cedc42593804f87298422df863048
SHA1 352cb37b02b37c4715cef9d5cd778e47b36e0dbc
SHA256 39d4d4a99c565d4a8cfc11a6bbbb29ee6dcd842c44e1a1f7f676c8704402d2ec
SHA512 40bb21b08889f6ca42b585ba24506ec8ca9c0954150c8733a5964cec5e2249aec9682f8db3185712e6977dbb44b03a3c76b0637047c90a939997cc91a4bdf5e5

memory/2160-930-0x000001D3BCFA0000-0x000001D3BCFA1000-memory.dmp

memory/2160-931-0x000001D3BDCB0000-0x000001D3BDCB1000-memory.dmp

memory/2160-933-0x000001D3BE410000-0x000001D3BE411000-memory.dmp

memory/2160-932-0x000001D3BE410000-0x000001D3BE411000-memory.dmp

memory/2160-935-0x000001D3BCEB0000-0x000001D3BCEB1000-memory.dmp

memory/2160-936-0x000001D3BF920000-0x000001D3BF921000-memory.dmp

memory/2160-938-0x000001D3BDE10000-0x000001D3BDE11000-memory.dmp

memory/2160-937-0x000001D3BDE10000-0x000001D3BDE11000-memory.dmp

memory/2160-940-0x000001D3C0740000-0x000001D3C0741000-memory.dmp

memory/2160-941-0x000001D3C17F0000-0x000001D3C17F1000-memory.dmp

memory/2160-943-0x000001D3C0680000-0x000001D3C0681000-memory.dmp

memory/2160-942-0x000001D3C18F0000-0x000001D3C18F1000-memory.dmp

memory/2160-945-0x000001D3C28D0000-0x000001D3C28D1000-memory.dmp

memory/2160-947-0x000001D3C2BA0000-0x000001D3C2BA1000-memory.dmp

memory/2160-946-0x000001D3C2BA0000-0x000001D3C2BA1000-memory.dmp

memory/2160-949-0x000001D3C3960000-0x000001D3C3961000-memory.dmp

memory/2160-951-0x000001D3C3F00000-0x000001D3C3F01000-memory.dmp

memory/2160-950-0x000001D3C3F00000-0x000001D3C3F01000-memory.dmp

memory/2160-953-0x000001D3C4BC0000-0x000001D3C4BC1000-memory.dmp

memory/2160-955-0x000001D3BCD60000-0x000001D3BCD61000-memory.dmp

memory/2160-954-0x000001D3BCD60000-0x000001D3BCD61000-memory.dmp

memory/2160-957-0x000001D3BF9F0000-0x000001D3BF9F1000-memory.dmp

memory/2160-958-0x000001D3C6A20000-0x000001D3C6A21000-memory.dmp

memory/2160-960-0x000001D3C6A90000-0x000001D3C6A91000-memory.dmp

memory/2160-959-0x000001D3C6A90000-0x000001D3C6A91000-memory.dmp

memory/2160-962-0x000001D3C7A30000-0x000001D3C7A31000-memory.dmp

memory/2160-964-0x000001D3C48D0000-0x000001D3C48D1000-memory.dmp

memory/2160-963-0x000001D3C48D0000-0x000001D3C48D1000-memory.dmp

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc

MD5 4f0e193b4cc3ad1cf37cb5ba68fbd062
SHA1 9494554878747cb108854d301cca8382668875eb
SHA256 32ca540d3b758cea736355e8e088574f4d0c9c26c6296f4226ceef95bb94e456
SHA512 b3f8093b5552fc740518384ff3e031ad134111d27a7aca8684ea0195f2a2815a45acc0b19ab2ced4733698b5ba2772ac0b5d436bf3f16f661237655b59f90a09

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc

MD5 11e35a762d17df6fc34f64bacc15fdc8
SHA1 c2ede44818b5bab929bb058e479da0b5a5936a5a
SHA256 274fd3ea239cf964de5b10a4274becf5a7956596235cdf610612ae5604f05dd2
SHA512 bd369d4fda05b0cf44f5a444f6d29b331b683e46e8f795141875c885ea950ef575d4ae9d647ed3091cb37f757270a9179866b9a3daaac7c6505b65ed3a00f239

C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc

MD5 9764f50d9253c71ff6f2cce5ee5259b7
SHA1 bc4dc81af5b7d601cff4149ac8de0e66343559f9
SHA256 6f891e54e3a8530d64d7b46375340265110f2669fee4dbc8eab50f866e60db80
SHA512 72d3f3fc75d68469d500532eb6565f1b8b96e1f9c2b7a5a430954c789863bcef434ff3365707d5fe6d49deb990c72b3df9030a86dc4dbfaedce4423eb077affd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E.1btc

MD5 394c681087090cd33edf9f964b1c89dd
SHA1 79dc6e6add82cc2e804f898880c9a6dd7fc7d4fe
SHA256 1045cf58e84a8940941edd2642f1924d8f80ad5f3a65d2169b9e57a51acdb74c
SHA512 1a862abc310a9e7cad24fdb6b527b90c3aa44a5dd039de896dd322c0c4b0939a759eec7a78884b25e399dfd9e891ab7226234f2c0516c44ddd33a4dbdd2ea9c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc

MD5 d782b2b76bd62631a1cd97c6152ddf44
SHA1 eb6901ac4258096ea7ef57225377e450f1e2329a
SHA256 30a36ff7cb2bc04fdbe9723538010c2e7743319fb9b432a39a3e6f2a6551dda8
SHA512 7244d6ac7a440815c32ebbb0617832106fd2fc523e4784bff39963f4fd24668d9e38de365de68bce51b7b4885a2a81b852a62280e051e9c32ca486ddd8a12bad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.1btc

MD5 a57b3314842e438a402845664c5a712c
SHA1 af83a808fa45ce462500d6cb61f24af2cee41e26
SHA256 4ef732e3203cb38e59860e3f4108edfe0ddae7c4690e81066f65c7144f36c771
SHA512 39e312115e49787be5331d673c5931b21a4569b62f6421cdacb6391bb3181e23baa99db0f89ec6c7c651f82535cd39393c9107bf486f1ef2a1be1000727a661b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F.1btc

MD5 8f16322fd472df3df24b77fe5b640831
SHA1 cc03190b53164f728540bd5a6a9c35558efe71e1
SHA256 1f9603f4a411e90024f5efd968494b15477acd9dc0058b4d1f58457717be7684
SHA512 d62522bff769b09052c77f1c2970bf044dfe6092c42e37b5be10f46689aa1433bae40deb6f72a97cb472954159238ff636299ef269d12d3aa1e829c03660e45f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc

MD5 3e6371f7696d2b943122e57bbd07c73e
SHA1 fb9cb7572522152b55d0c4becfed314237009b80
SHA256 92927dd6c6bc12e3ec8afafcc635fec0adc076b7045998ae5e5cfad946ab75db
SHA512 56705434da09efae752259b95bd1ad64373d44f7bc01b4b4b205ec0ccf3acdbc06fd082c19ea534a2f2d752a7974d372907d2438445acb5650654bcb234835b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc

MD5 40cde007a09354d3987f611037c6e7fe
SHA1 fb59d9dea777f3bc3ef8eb1d91c6ed8cf413f4fe
SHA256 2ab8ab8b20b59e38f7b284e593bc6510490a41ca53283855afeefbeef602aea3
SHA512 a84582533d087b4d2063ecce92c8b14f327e3f0ec492242b9d28556cb1887fd8fde7b8676a8b621cc1700bbac84626ceb299b7ffae29fbeb831b28a5512be5e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2367C848C1C8A11F6F3502EDA2855348.1btc

MD5 dd2fd021c5e67b19c550218403215b2d
SHA1 fc31b2edc263a971a98a2504945273379d9d296a
SHA256 36dbc1fe9451872c6f5e0178fdc7dc6066d41018dec607852f6b830f55e9e72f
SHA512 5c2c3b93c0cb64924bf93a47101bfd9d36a9352f5c0c6eaf430cc8563ae4f63e20b48a3f94dbd205b9d4ebbcdab515a6752fa08b0a567df00729cac71423f486