6112da76e670a9c450c3f55c1bcafe22ddd199983470ab8d7e24c03688524387

Analysis

max time kernel
94s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
Size

1.3MB
MD5

728cb2fb25ddc3b86db2e1f72cf48dd3
SHA1

2bd7722674d804c3087d63a51fe0287ff04229d9
SHA256

6112da76e670a9c450c3f55c1bcafe22ddd199983470ab8d7e24c03688524387
SHA512

450b947b902e8119a6166bdef63dfca0dc0aa51b008d31247f68402929dc0feec9467c3497c72ec3bfd56269989baff2b5bf6e9b3aa92b6ba0f44d77c0e802b9
SSDEEP

12288:QmHAIqyfF/5ebyz1dpPlRnMRTD410ALP68kG3Jz4S9FUmnyJtgoiOHmabd8ornXn:HHRFfauvpPXnMKqJtfiOHmUd8QTH3

Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\da-DK\!!!HOW_TO_DECRYPT!!!.mht

Ransom Note

From: =?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?= Subject: Date: San, 00 Jan 2000 00:00:00 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft MimeOLE =EF=BB=BF<!DOCTYPE HTML> <!DOCTYPE html PUBLIC "" "">=20 <HTML lang=3D"ru">=20 <HEAD>=20 <META = content=3D"IE = 3D11.0000" http-equiv=3D"X - UA - Compatible">=20 <META charset=3D"utf-8">=20 <TITLE>!!!HOW_TO_DECRYPT!!!</TITLE>=20 <LINK href=3D"style.css" rel=3D"stylesheet">=20 <META name=3D"GENERATOR" content=3D"MSHTML 11.00.10570.1001">=20 </HEAD>=20 <BODY>=20 =20 =20 All your valiable data has been encrypted! =20 =20 =20 Hello! Sorry, but we have inform you that your order has been blocked due to the issue of securities. Make sure your data is not blocked.=20 All your valuable files were encrypted with strong encryption algorithms AES-256 + RSA-2048 + CHACHA and renamed. You can read about these algorithms in Google.=20 Your unique encryption key is stored securely on our server and your data can be decrypted quickly and securely. =20 We can prove that we can decrypt all of your data. Please just send us 3 small encrypted files which are randomly stored on your server.=20 We will decrypt these files and send them to you as a proof. Please note that files for free test decryption should not contain valuable information. =20 As you know information is the most valuable resource in the world. That's why all of your confidential data was uploaded to our servers.=20 If you need proof, just write us and we will show you that we have your files. If you will not start a dialogue with us in 72 hours=20 we will be forced to publish your files in the Darknet. Your customers and partners will be informed about the data leak by email or phone. =20 This way, your reputation will be ruined. If you will not react, we will be forced to sell the most important information such as databases=20 to interested parties to generate some profit. Please understand that we are just doing our job. We don't want to harm your company.=20 Think of this incident as an opportunity to improve your security. We are opened for dialogue and ready to help you. We are professionals,=20 please don't try to fool us. =20 =20 If you want to resolve this situation, please write to ALL of these 2 email addresses: =20 [email protected] [email protected] In subject line please write your ID: 15173074851192133587 =20 =20 =20 Important! =20 * We asking to send your message to ALL of our 2 email adresses because for various reasons, your email may not be delivered. =20 * Our message may be recognized as spam, so be sure to check the spam folder. =20 * If we do not respond to you within 24 hours, write to us from another email address. Use Gmail, Yahoo, Hotmail, or any other well-known email service. =20 Important =20 * Please don't waste the time, it will result only additinal damage to your company! =20 * Please do not try to decrypt the files yourself. We will not be able to help you if files will be modified. =20 =20 =20 </BODY> =20 </HTML>

Emails

[email protected] [email protected] In

URLs

http-equiv=3D"X

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1540 bcdedit.exe
4556 bcdedit.exe
Renames multiple (717) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

4400 wbadmin.exe
3736 wbadmin.exe

pid	process
1540	bcdedit.exe
4556	bcdedit.exe

pid	process
4400	wbadmin.exe
3736	wbadmin.exe

Drops file in Drivers directory 13 IoCs

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe\" e"	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

description	ioc	process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Enumerates connected drives 3 TTPs 39 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exe20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\M:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\P:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\R:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\V:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\S:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\U:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\W:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\I:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\J:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\Z:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\F:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\K:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\O:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\T:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\D:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\H:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\N:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\X:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\G:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\Y:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\E:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\A:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\B:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\L:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\Q:	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened (read-only)	\??\h:	vssadmin.exe

Drops file in System32 directory 64 IoCs

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\ELAM.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\system32\CatRoot2\edbres00002.jrs	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\DRIVERS.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\system32\CatRoot2\edb.chk	svchost.exe
File created	C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\ResPriImageListLowCost	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\BCD-Template	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\73b1fb18-2342-425d-93a4-2f2897256b03	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\system32\CatRoot2\edb.log	svchost.exe
File opened for modification	C:\Windows\System32\ResPriHMImageListLowCost	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\DRIVERS.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.jfm	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\BBI	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\eb6b0174-c98b-4422-934f-872812cfa039.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\73b1fb18-2342-425d-93a4-2f2897256b03.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\DEFAULT	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\bc50a4a9-b4b9-420a-b453-3b605987ef97.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\system32\CatRoot2\edbtmp.log	svchost.exe
File created	C:\Windows\system32\CatRoot2\edb.chk	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\SYSTEM	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\1757fe63-e7ad-4838-9a80-f4d19aa7ca3f.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\System32\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.jfm	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Drops file in Program Files directory 64 IoCs

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Mozilla Firefox\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Google\Chrome\Application\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\MsEdgeCrashpad\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Drops file in Windows directory 64 IoCs

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exewbadmin.exewbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_d2547453-e731-4fdf-8f92-95f955a44aca.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{71024AE4-039E-4CA4-87B4-2F64180401F0}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{71024AE4-039E-4CA4-87B4-2F64180401F0}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{BF08E976-B92E-4336-B56F-2171179476C4}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Panther\setupinfo	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{7DAD0258-515C-3DD4-8964-BD714199E0F7}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Boot\DVD\PCAT\BCD	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\SoftwareDistribution\Download\SharedFileCache\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Panther\setupinfo.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\Installer\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{71024AE4-039E-4CA4-87B4-2F64180401F0}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{662A0088-6FCD-45DD-9EA7-68674058AED5}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{E634F316-BEB6-4FB3-A612-F7102F576165}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{B175520C-86A2-35A7-8619-86DC379688B9}.1btc	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File created	C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Boot\DVD\EFI\BCD	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\e1ea7b2e20a22fbee6e9dd5d883e9f3cc75fdee790ea383a755da4381088ec52	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\SharedFileCache\ffb218cb78a2ca5b027e463f2a6bbb9c7036730212098e4fb7c330c70dcdfda4.inprocess	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
File opened for modification	C:\Windows\Installer\SourceHash{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 13 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
4376	vssadmin.exe
2860	vssadmin.exe
1940	vssadmin.exe
228	vssadmin.exe
4348	vssadmin.exe
2316	vssadmin.exe
4976	vssadmin.exe
2216	vssadmin.exe
4752	vssadmin.exe
4836	vssadmin.exe
2304	vssadmin.exe
4296	vssadmin.exe
4520	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

pid	process
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vssvc.exewmic.exe

description	pid	process
Token: SeBackupPrivilege	1412	vssvc.exe
Token: SeRestorePrivilege	1412	vssvc.exe
Token: SeAuditPrivilege	1412	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4336	wmic.exe
Token: SeSecurityPrivilege	4336	wmic.exe
Token: SeTakeOwnershipPrivilege	4336	wmic.exe
Token: SeLoadDriverPrivilege	4336	wmic.exe
Token: SeSystemProfilePrivilege	4336	wmic.exe
Token: SeSystemtimePrivilege	4336	wmic.exe
Token: SeProfSingleProcessPrivilege	4336	wmic.exe
Token: SeIncBasePriorityPrivilege	4336	wmic.exe
Token: SeCreatePagefilePrivilege	4336	wmic.exe
Token: SeBackupPrivilege	4336	wmic.exe
Token: SeRestorePrivilege	4336	wmic.exe
Token: SeShutdownPrivilege	4336	wmic.exe
Token: SeDebugPrivilege	4336	wmic.exe
Token: SeSystemEnvironmentPrivilege	4336	wmic.exe
Token: SeRemoteShutdownPrivilege	4336	wmic.exe
Token: SeUndockPrivilege	4336	wmic.exe
Token: SeManageVolumePrivilege	4336	wmic.exe
Token: 33	4336	wmic.exe
Token: 34	4336	wmic.exe
Token: 35	4336	wmic.exe
Token: 36	4336	wmic.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

description	pid	process	target process
PID 3436 wrote to memory of 228	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 228	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4348	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4348	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4296	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4296	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4752	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4752	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4376	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4376	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2860	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2860	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4520	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4520	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2304	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2304	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4836	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4836	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2316	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2316	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 1940	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 1940	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4976	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 4976	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2216	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 2216	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	vssadmin.exe
PID 3436 wrote to memory of 1540	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	bcdedit.exe
PID 3436 wrote to memory of 1540	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	bcdedit.exe
PID 3436 wrote to memory of 4556	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	bcdedit.exe
PID 3436 wrote to memory of 4556	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	bcdedit.exe
PID 3436 wrote to memory of 4400	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	wbadmin.exe
PID 3436 wrote to memory of 4400	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	wbadmin.exe
PID 3436 wrote to memory of 3736	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	wbadmin.exe
PID 3436 wrote to memory of 3736	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	wbadmin.exe
PID 3436 wrote to memory of 4336	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	wmic.exe
PID 3436 wrote to memory of 4336	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	wmic.exe
PID 3436 wrote to memory of 4612	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	cmd.exe
PID 3436 wrote to memory of 4612	3436	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe	cmd.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240703728cb2fb25ddc3b86db2e1f72cf48dd3medusalocker.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3436
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:228
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4348
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4296
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4752
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4376
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2860
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4520
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2304
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4836
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2316
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1940
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4976
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:2216
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1540
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4556
- C:\Windows\SYSTEM32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:4400
- C:\Windows\SYSTEM32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:3736
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\202407~1.EXE >> NUL
  2⤵
  PID:4612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
1⤵
PID:116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2367C848C1C8A11F6F3502EDA2855348.1btc

Filesize
824B

MD5
f825e0285e56dc0bdf4d638a4f9507da

SHA1
576d2b292e349b5e9091945e591677d49ce605b0

SHA256
3698ac77f77d3a0a2a0406f287cc006087d89a07d855ace1b08edaafaec47d01

SHA512
e54b19e9ac2e9a5617f486b21ea4071196b8d13cecf1f27a1a6229d56731256b9f43f5f889e77feaac4df5e8d8d7f71aa45c7fe0517ce96ca891e516db9bd672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc

Filesize
814B

MD5
f2aaaa6a79258309613789ac50f845db

SHA1
5d2fee86d02acd8f81aa3aaa18ee26c47b0caf9b

SHA256
6aa9c9c7cf19ba4e59ea00a2b3df6aa843310b9f61a5fdf4e2dfe8b3a842790c

SHA512
aafa09c7d073c695299fa860371cdce360587a8e1b02776145248357aac09de7d6ce85d32470249d38e709653ee7c1ff27ed9c73a2b96ffadbc74c21b84b3c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc

Filesize
842B

MD5
72b5b45e086f05351cbb59c135f8b006

SHA1
693281f77336c17141be210be4a840bcd3f7f613

SHA256
196686971424dcea3463199d3e6904ba950d2e1bc37092501221ac693e1816d0

SHA512
5436d532ada04e5d270e80a6402460b3a5a2695043b1355f98081214babe9b9e03bc1715e44a5324d70c9871f50ff25ed58ea6ee2a674113f723578d9ae8d169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F.1btc

Filesize
700B

MD5
897ee1f15ffeaf1a72903f24d7877247

SHA1
941b9fd34ef75688b7b8b87dc184033efefcb3e7

SHA256
919d98650f30ee7a7f32ec30a515b07ec6c4dc408b4c7476c710fa4ddf87d14c

SHA512
c0ccc2e6881fe895840c2eb2d1ff45d8b723ab81be03cb244960784b776314decc12ea936d4a85307c5a5c242426af9414ba0d94526b6e765ae123416da8791b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.1btc

Filesize
770B

MD5
e9f01332401e643deccabfcb294ac3bd

SHA1
62fcee05d3055a416f9867208936e8f56d97ae66

SHA256
1f4afdf97f00eb76e94eb798daab3581fae062eed840ba12621ff46d3570e6a0

SHA512
0dbb01aace59f93a447c7fbe00bcbb292f70da827f13e12f065404fa70c875723f40c6598020ae10fce93c43fce5a5131a21fa93cb5353f9d4c604c6c0b9a588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

Filesize
290B

MD5
ff51eb94d634d2871caa30ec33d09dc1

SHA1
dd8d38b2f22e151da928bbf9f6ee673ffd1a61f3

SHA256
6cd5841cbd7bd291db200bfd4c6f5b79a75d0fc4747d2e183c8846b01125c812

SHA512
47c32c5f8629b1c842c4cf22fda0ed23687cfc679a233240fdb3197576ca915d08a0f6778288d50d870f956f9fcbf7d13408f1afb8f38bed3e4fb7545d9011dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc

Filesize
842B

MD5
655f4258dab1c4cd39af55015236d7ee

SHA1
9f865b4d89105f29e309c46b92bf03d0c554a9fa

SHA256
68f1d3a251806a01b79ebc2cf93d4e3af973b96d427bf2f42f911d15eca340d6

SHA512
6b44bc94967cd49ac7992ea1328e2f2515aab1cd9ea88000b743079f83e07fe5fbca1f62cb6c6901875e1feef2dddf20b27574a6598492c8b0ccca243d793d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E.1btc

Filesize
782B

MD5
18dc905467a2ecfa7b27cf8f0e43a611

SHA1
cd2ba2e5ccf04b9f5a59d9964384eb56e75b369f

SHA256
cff6bfb51ce88ef42b6fec3a89ad590bec1b500473ae23cb59fe6effe3ede07e

SHA512
a1f7e799bfb77a5dcfe1e3edf16c399d2cd87836c82fc48fb81ae9e79d94ee5a38f3e1f26083a2f7684c22a6b5bd4cd973ad31cd72c1841355bf87c1011ff2ea

Download Submit
\Device\HarddiskVolume1\Boot\da-DK\!!!HOW_TO_DECRYPT!!!.mht

Filesize
4KB

MD5
c9adc207ece8f4e5743c9de9c2f8e766

SHA1
577a5e4874b0f4fcd6d5c70fbe6137298f571fa3

SHA256
7de544b06816575355f2992daa7b580bf2f91e52fd73be0b0b66c043ba5db1e3

SHA512
155d255dfcebca5823e688bd468364e8e56233618b236dc8b311bbcf316b05a08cfc05c7bf697e0294d626b95ccbbe2584f77922d50d30441ba8675838040815

Download Submit
memory/2372-1105-0x0000027698B80000-0x0000027698B81000-memory.dmp

Filesize
4KB

Download
memory/2372-1112-0x0000027698DC0000-0x0000027698DC1000-memory.dmp

Filesize
4KB

Download
memory/2372-1109-0x0000027698CE0000-0x0000027698CE1000-memory.dmp

Filesize
4KB

Download
memory/2372-1108-0x0000027698CC0000-0x0000027698CC1000-memory.dmp

Filesize
4KB

Download
memory/2372-1107-0x0000027698B80000-0x0000027698B81000-memory.dmp

Filesize
4KB

Download
memory/2372-1103-0x0000027698AE0000-0x0000027698AE1000-memory.dmp

Filesize
4KB

Download
memory/2372-1075-0x00000276947D0000-0x00000276947E0000-memory.dmp

Filesize
64KB

Download
memory/2372-1069-0x0000027694770000-0x0000027694780000-memory.dmp

Filesize
64KB

Download