Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 09:24
Behavioral task
behavioral1
Sample
20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
Resource
win10v2004-20240508-en
General
-
Target
20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
-
Size
1.3MB
-
MD5
728cb2fb25ddc3b86db2e1f72cf48dd3
-
SHA1
2bd7722674d804c3087d63a51fe0287ff04229d9
-
SHA256
6112da76e670a9c450c3f55c1bcafe22ddd199983470ab8d7e24c03688524387
-
SHA512
450b947b902e8119a6166bdef63dfca0dc0aa51b008d31247f68402929dc0feec9467c3497c72ec3bfd56269989baff2b5bf6e9b3aa92b6ba0f44d77c0e802b9
-
SSDEEP
12288:QmHAIqyfF/5ebyz1dpPlRnMRTD410ALP68kG3Jz4S9FUmnyJtgoiOHmabd8ornXn:HHRFfauvpPXnMKqJtfiOHmUd8QTH3
Malware Config
Extracted
C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\!!!HOW_TO_DECRYPT!!!.mht
[email protected]<BR>[email protected]<BR>In
http-equiv=3D"X
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2216 bcdedit.exe 1712 bcdedit.exe -
Renames multiple (912) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 772 wbadmin.exe 1040 wbadmin.exe -
Drops file in Drivers directory 13 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\protocol 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\networks 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\services.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\services.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\networks.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\drivers\etc\services 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Deletes itself 1 IoCs
pid Process 808 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe\" e" 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Enumerates connected drives 3 TTPs 39 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\J: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\K: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\O: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\D: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\W: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\Y: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\Z: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\A: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\G: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\E: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\F: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\P: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\S: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\B: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\Q: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\R: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\I: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\L: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\V: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\M: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\N: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\X: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\T: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened (read-only) \??\U: 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\COMPONENTS 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\a4ad412a-3915-4550-8bba-72246c19e5e1 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\665bc9f6-7f2d-490a-af1a-6cf01053efa7 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\RegBack\SAM 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\DEFAULT 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\RegBack\SYSTEM 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\SOFTWARE 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\RegBack\DEFAULT 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\a4ad412a-3915-4550-8bba-72246c19e5e1.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\7e3cc138-ca73-428a-95ae-ba81cc3e5599.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\SECURITY 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\BCD-Template.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\665bc9f6-7f2d-490a-af1a-6cf01053efa7.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\7e3cc138-ca73-428a-95ae-ba81cc3e5599 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\BCD-Template 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\COMPONENTS.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\config\RegBack\SOFTWARE 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayenne.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\security\cacerts.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Halifax.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Accra.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Phoenix.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montreal 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Budapest 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Araguaina 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Dawson.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Denver 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Fortaleza 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Drops file in Windows directory 50 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb2 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Panther\setupinfo 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\dewindow 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb2 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th1 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_1 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_2 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_3 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Panther\setupinfo.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Boot\DVD\EFI\BCD 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb1 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th0 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th2 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_0 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\enwindow 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File created C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Boot\DVD\PCAT\BCD 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_2 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File created C:\Windows\ehome\CreateDisc\Components\tables\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb0 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb1 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.1btc 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Panther\setupinfo.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb0 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_1 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_0 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th1 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th2 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th0 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.inprocess 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File created C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe File opened for modification C:\Windows\Boot\PCAT\bootmgr 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 13 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2596 vssadmin.exe 2812 vssadmin.exe 2032 vssadmin.exe 2700 vssadmin.exe 1668 vssadmin.exe 2920 vssadmin.exe 2016 vssadmin.exe 1792 vssadmin.exe 2984 vssadmin.exe 2520 vssadmin.exe 1836 vssadmin.exe 1952 vssadmin.exe 2188 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeBackupPrivilege 2760 vssvc.exe Token: SeRestorePrivilege 2760 vssvc.exe Token: SeAuditPrivilege 2760 vssvc.exe Token: SeIncreaseQuotaPrivilege 2400 wmic.exe Token: SeSecurityPrivilege 2400 wmic.exe Token: SeTakeOwnershipPrivilege 2400 wmic.exe Token: SeLoadDriverPrivilege 2400 wmic.exe Token: SeSystemProfilePrivilege 2400 wmic.exe Token: SeSystemtimePrivilege 2400 wmic.exe Token: SeProfSingleProcessPrivilege 2400 wmic.exe Token: SeIncBasePriorityPrivilege 2400 wmic.exe Token: SeCreatePagefilePrivilege 2400 wmic.exe Token: SeBackupPrivilege 2400 wmic.exe Token: SeRestorePrivilege 2400 wmic.exe Token: SeShutdownPrivilege 2400 wmic.exe Token: SeDebugPrivilege 2400 wmic.exe Token: SeSystemEnvironmentPrivilege 2400 wmic.exe Token: SeRemoteShutdownPrivilege 2400 wmic.exe Token: SeUndockPrivilege 2400 wmic.exe Token: SeManageVolumePrivilege 2400 wmic.exe Token: 33 2400 wmic.exe Token: 34 2400 wmic.exe Token: 35 2400 wmic.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2984 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 28 PID 2104 wrote to memory of 2984 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 28 PID 2104 wrote to memory of 2984 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 28 PID 2104 wrote to memory of 2700 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 33 PID 2104 wrote to memory of 2700 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 33 PID 2104 wrote to memory of 2700 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 33 PID 2104 wrote to memory of 1668 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 35 PID 2104 wrote to memory of 1668 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 35 PID 2104 wrote to memory of 1668 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 35 PID 2104 wrote to memory of 2520 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 37 PID 2104 wrote to memory of 2520 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 37 PID 2104 wrote to memory of 2520 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 37 PID 2104 wrote to memory of 2596 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 39 PID 2104 wrote to memory of 2596 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 39 PID 2104 wrote to memory of 2596 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 39 PID 2104 wrote to memory of 2920 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 41 PID 2104 wrote to memory of 2920 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 41 PID 2104 wrote to memory of 2920 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 41 PID 2104 wrote to memory of 1836 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 43 PID 2104 wrote to memory of 1836 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 43 PID 2104 wrote to memory of 1836 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 43 PID 2104 wrote to memory of 1952 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 45 PID 2104 wrote to memory of 1952 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 45 PID 2104 wrote to memory of 1952 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 45 PID 2104 wrote to memory of 2812 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 47 PID 2104 wrote to memory of 2812 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 47 PID 2104 wrote to memory of 2812 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 47 PID 2104 wrote to memory of 2016 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 49 PID 2104 wrote to memory of 2016 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 49 PID 2104 wrote to memory of 2016 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 49 PID 2104 wrote to memory of 2188 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 51 PID 2104 wrote to memory of 2188 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 51 PID 2104 wrote to memory of 2188 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 51 PID 2104 wrote to memory of 1792 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 53 PID 2104 wrote to memory of 1792 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 53 PID 2104 wrote to memory of 1792 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 53 PID 2104 wrote to memory of 2032 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 55 PID 2104 wrote to memory of 2032 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 55 PID 2104 wrote to memory of 2032 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 55 PID 2104 wrote to memory of 2216 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 57 PID 2104 wrote to memory of 2216 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 57 PID 2104 wrote to memory of 2216 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 57 PID 2104 wrote to memory of 1712 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 59 PID 2104 wrote to memory of 1712 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 59 PID 2104 wrote to memory of 1712 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 59 PID 2104 wrote to memory of 772 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 61 PID 2104 wrote to memory of 772 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 61 PID 2104 wrote to memory of 772 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 61 PID 2104 wrote to memory of 1040 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 63 PID 2104 wrote to memory of 1040 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 63 PID 2104 wrote to memory of 1040 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 63 PID 2104 wrote to memory of 2400 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 65 PID 2104 wrote to memory of 2400 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 65 PID 2104 wrote to memory of 2400 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 65 PID 2104 wrote to memory of 808 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 68 PID 2104 wrote to memory of 808 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 68 PID 2104 wrote to memory of 808 2104 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe 68 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe"C:\Users\Admin\AppData\Local\Temp\20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2104 -
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:2984
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:2700
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1668
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2520
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2596
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2920
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1836
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1952
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2812
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2016
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2188
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1792
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2032
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:2216
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1712
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:772
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1040
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\202407~1.EXE >> NUL2⤵
- Deletes itself
PID:808
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD58a2471b0964b0d7db0e445ca2f1e7cb1
SHA10390b882c357780e499ab8c09719d4712204a77d
SHA256deb2346fc826267262737d588fb734f9633033ba19beb525fca8ea8e858c5829
SHA512a5d985cfe274efbaa71c047b0810324dca18df2779715a774cc95ac187246b48c3c773c7ef74de8cb6b3272863b1023af981eca64a62b031c654bd4bfd4066a0