Overview

overview

10

Static

static

10

2024-08-19...er.exe

windows7-x64

10

2024-08-19...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 06:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-19_6ed1340ddb072eb54f9f9a060e99d78b_medusalocker.exe

  • Size

    1.2MB

  • MD5

    6ed1340ddb072eb54f9f9a060e99d78b

  • SHA1

    da6f3948b114abe18e71362a108df8aac8f6b7fb

  • SHA256

    e6b57ce63de7ec74e623a343175b41ccc09e68de26d30189f8fd50327ab648c5

  • SHA512

    da6673221531f2aa88f2515e8602726e9d4d31af42cb88123e6faf549a3814c58dcef4eaaa128ba786f8bced03af8ebe724b12d9393a7fde65c5cd983566e8b5

  • SSDEEP

    12288:zmHAIqyfF/5ebyz1dpPlRnMRTD410ALP68kG3Jz4S9FUmnyJtgoiOHmabd8ornXu:qHRFfauvpPXnMKqJtfiOHmUd8QTH+

Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\!!!HOW_TO_DECRYPT!!!.mht

Ransom Note
From: =?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?= Subject: Date: San, 00 Jan 2000 00:00:00 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft MimeOLE =EF=BB=BF<!DOCTYPE HTML> <!DOCTYPE html PUBLIC "" "">=20 <HTML lang=3D"ru">=20 <HEAD>=20 <META = content=3D"IE = 3D11.0000" http-equiv=3D"X - UA - Compatible">=20 <META charset=3D"utf-8">=20 <TITLE>!!!HOW_TO_DECRYPT!!!</TITLE>=20 <LINK href=3D"style.css" rel=3D"stylesheet">=20 <META name=3D"GENERATOR" content=3D"MSHTML 11.00.10570.1001">=20 </HEAD>=20 <BODY>=20 <p class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><span class=3DSpellE><b>=20 <span lang=3DEN-US style=3D'font-size:20.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial;color:#C9211E'>=20 All your valiable data has been encrypted!</span></b></span></p><BR><BR>=20 <p class=3DMsoNormal style=3D'text-align:justify;text-justify:inter-ideograph'>=20 <span class=3DSpellE><span lang=3DEN-US style=3D'font-size:13.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial'>=20 Hello!<BR>Sorry, but we have inform you that your order has been blocked due to the issue of securities. Make sure your data is not blocked.=20 All your valuable files were encrypted with strong encryption algorithms AES-256 + RSA-2048 + CHACHA and renamed. You can read about these algorithms in Google.=20 Your unique encryption key is stored securely on our server and your data can be decrypted quickly and securely.<BR><BR>=20 We can prove that we can decrypt all of your data. Please just send us 3 small encrypted files which are randomly stored on your server.=20 We will decrypt these files and send them to you as a proof. Please note that files for free test decryption should not contain valuable information.<BR><BR>=20 As you know information is the most valuable resource in the world. That's why all of your confidential data was uploaded to our servers.=20 If you need proof, just write us and we will show you that we have your files. If you will not start a dialogue with us in 72 hours=20 we will be forced to publish your files in the Darknet. Your customers and partners will be informed about the data leak by email or phone.<BR><BR>=20 This way, your reputation will be ruined. If you will not react, we will be forced to sell the most important information such as databases=20 to interested parties to generate some profit.<BR><BR>Please understand that we are just doing our job. We don't want to harm your company.=20 Think of this incident as an opportunity to improve your security. We are opened for dialogue and ready to help you. We are professionals,=20 please don't try to fool us.<BR></span></span></p><BR><BR><p class=3DMsoNormal align=3Dcenter style=3D'text-align:center'><b>=20 <span lang=3DEN-US style=3D'font-size:14.0pt;font-family:"Times New Roman","serif";mso-bidi-font-family:Arial'>=20 If you want to resolve this situation,<BR>please write to ALL of these 2 email addresses:<BR>=20 [email protected]<BR>[email protected]<BR>In subject line please write your ID: 16406006299838607087</span></b></p><BR><BR>=20 <p class=3DMsoNormal style=3D'text-align:justify;text-justify:inter-ideograph'><b>=20 <span lang=3DEN-US style=3D'font-family:"Times New Roman","serif";mso-bidi-font-family: Arial;color:#C9211E'>=20 Important!<BR>=20 * We asking to send your message to ALL of our 2 email adresses because for various reasons, your email may not be delivered.<BR>=20 * Our message may be recognized as spam, so be sure to check the spam folder.<BR>=20 * If we do not respond to you within 24 hours, write to us from another email address. Use Gmail, Yahoo, Hotmail, or any other well-known email service.<BR>=20 Important<BR>=20 * Please don't waste the time, it will result only additinal damage to your company!<BR>=20 * Please do not try to decrypt the files yourself. We will not be able to help you if files will be modified.<BR>=20 </span></b></p>=20 <BR>=20 </BODY><BR>=20 </HTML>
URLs

http-equiv=3D"X

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (660) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops file in Drivers directory 13 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 39 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 13 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-19_6ed1340ddb072eb54f9f9a060e99d78b_medusalocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-19_6ed1340ddb072eb54f9f9a060e99d78b_medusalocker.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5068
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
      2⤵
      • Interacts with shadow copies
      PID:1764
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
      2⤵
      • Interacts with shadow copies
      PID:3788
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:4344
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:4796
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:5052
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2868
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:5032
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2888
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:4476
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:2064
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:1456
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
      2⤵
      • Enumerates connected drives
      • Interacts with shadow copies
      PID:1812
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:1228
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:1468
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2936
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:4820
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:2972
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3660
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE >> NUL
      2⤵
        PID:1108
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3576
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
      1⤵
        PID:1628

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Direct Volume Access

      1
      T1006

      Indicator Removal

      4
      T1070

      File Deletion

      4
      T1070.004

      Modify Registry

      2
      T1112

      Credential Access

      Credentials from Password Stores

      2
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Windows Credential Manager

      1
      T1555.004

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      2
      T1012

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      4
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\!!!HOW_TO_DECRYPT!!!.mht
        Filesize

        4KB

        MD5

        6c9802af3f6e0a61622450190b83ba01

        SHA1

        012085091cbee1f23b2d71be98a39229027ec891

        SHA256

        3147bf9c07b164a1b9ae1c3987a9d678110be3990a81083c3180b755745e87a6

        SHA512

        775fd470d751cb0c5177dd9bfff6f7b638a79bcdb7bf73170029c59337ea4388b3ed79241487b961b5235b74c68902733f6a75875840946ec687fc18bcf8966c

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2367C848C1C8A11F6F3502EDA2855348.1btc
        Filesize

        824B

        MD5

        9fc08074c5b7026f113764e3b790e2a7

        SHA1

        f1103c90702788099ea6f38aefa8b878691fa3cb

        SHA256

        672862ec9e5cc86b1635190520e6bb5f89443eecd45530845f761f616ab6c63f

        SHA512

        6ebfc40ff74d598c1a45bf01684650f7764ae972c5f6f20e6d424667ea428efd6b9deffe4bbde62f23f037c65dc1902f90812f10a3d539777e69a6691c721de7

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc
        Filesize

        814B

        MD5

        301bd32cde891bfa2c8fb07137bd83f1

        SHA1

        6cbaaf4834afe56eeec31ec93f75b364c55b1a08

        SHA256

        3bcb5ab46e6eb3fa5d88c0e2a95ef8cee26c7f5970fa1a1479719b6eb606cfff

        SHA512

        735a12568adb49510e2e5f76fdbe8fd44a77c693e796170179c198b73c9ad268b85ecc4f3e3ffbe302ed12f7adae60c970a305bffa7712267b5ce74e83454f7c

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc
        Filesize

        840B

        MD5

        d48a22e08b7b570cb26e5f179dbe1cfd

        SHA1

        163161c10f561e875144863186b15f02f021796d

        SHA256

        52e5e539b8cc7edf80cf79043297925baec23b9bdf920aae79cc4f16325ceaa1

        SHA512

        fceeec26005b857f88029ee84629c7c1a64d5dfb4fc469c2760936c42d7eccb044a22f00b521f401fcd19927176712fc96f13ef0ab325ceb08e39ee6188324ca

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F.1btc
        Filesize

        700B

        MD5

        113aa90716636f6ed0950fa20cc73dce

        SHA1

        3e020d71ba10f7e416e9ef63cddd1fb19bb6a8c0

        SHA256

        fae75050d4108e7699ee2cdd73cbdb4a25ffe734bdd8b655cb97daa9ff7ad964

        SHA512

        6eb0f0a3ee37e7803c0e78567984d79c09b49d722dde157f98a5b1053f6811b1323eeef98d3b14c5844ede7118a8560c5c07b7c2aaa3216a2bbf7590fb7bcfad

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C86BD7751D53F10F65AAAD66BBDF33C7.1btc
        Filesize

        770B

        MD5

        a349366c177683fe5e12a23db3e92df8

        SHA1

        7604381f646f3ec159de911ba25728683fdd071b

        SHA256

        fa74a801dd9a4cc40394bac22afb90d5dffc507fceb48827deec43989456b27e

        SHA512

        f389e2a60713f57ed5ae3bed68d2f97c520a0c6a20cf8535577d2d37c5807a3e420905813b8c699c6df92a096e50cc99793f1f55ff67a014a6cc2feb96127078

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
        Filesize

        290B

        MD5

        2f7949d01e79336aab0cc38e94f780e3

        SHA1

        7524ddf36c8581f97159004c7dc226f1d11dbc58

        SHA256

        482e1ea37b3bf550fa3a0eba5cab30c4ca8d799c84901686bea3e9f595e1cb05

        SHA512

        2440fd103ac07fc57e5369a627ca37f0d97ad0e116bab14fb23a4423aa3d9215717c112ebd6b6f81dfcd8a6507a01cfc4ab2a5d5a2a253ba3b5d0e24f549d412

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc
        Filesize

        842B

        MD5

        13b33d314e6f9f6efab584e68b7f91c9

        SHA1

        e6bfb19ef7a3f10ea5e1ad2d76d0ed30c5f8c0d3

        SHA256

        6bda003c4e40a76865fb4bdc12918063434895b75f0019e029c017e8efb9074c

        SHA512

        f8d4ddaa15b6111b632c80884130fbe3befcf70435258c3882b5bd87bf0d9f40819ac575ea27d8e71aee08bfe13e6ccd40213dd215bfa4a6126c6c65ab6360ce

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB5E2F83CE9B8330B0590B7CD2E5FF2E.1btc
        Filesize

        782B

        MD5

        30e5a1245077d78529f2164e195eb650

        SHA1

        df3f059ed241c49f7dd248257034cc7b06ff2bf3

        SHA256

        4d7c719163aa06807c3a02bc44d5315b2458efb340feb7610b967569e1951df9

        SHA512

        cdcbeb7a97effa2797ebf39d153ca099fb42c5119b5bfb44651ab63ef10954d3d9326cca515f3615988baafb61895b747d8d0a61666bbe9560cd15d970b72e9a

        Download Submit

      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.1btc
        Filesize

        850B

        MD5

        4c67aa86f0b2110665111b122a3db2fd

        SHA1

        d01ba39768bb0c6c9ed60cdc6570393da6106da1

        SHA256

        3de9cbe10cc9ba83c569ca9a162c6182289034527e319c4da9643d6dd814323f

        SHA512

        30e6582e9c173b0fa2eed5e08996e75aae287b6833f6ab31c036f13c4de9369e0ff5cdf5eedcf7fa3fc77e1e0ea6e29a129f0f7519052046ea02c3e782a65466

        Download Submit

      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.1btc
        Filesize

        802B

        MD5

        3f44c99c3a1499395f472abd6732ce9d

        SHA1

        697bd564c2d35e630e099e852302e25a18fb2828

        SHA256

        a5002d9dc910ab1c0e7a3a5beaeb400d04e0fd12f32f6b998b2ecf72eebc5768

        SHA512

        309eb61390932f8c29347e1a8987780bdcb49cdcbfd694b7edca6abb82f4caa0f5a5e6a7291cf08c1f8b43cb3be86a797f1f338b8305feffaf9d97960efc4ab5

        Download Submit

      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.1btc
        Filesize

        842B

        MD5

        4fd9833628a1d6fe435513e43343c6bd

        SHA1

        c6c39d1902bc4b2ad77732e20349a50a91f9feaf

        SHA256

        0b3220049d83d7b23c4186400fa10630f26cf923be5ca8163e1b251c860ed24c

        SHA512

        1893aa22d4bcca97666ffdb29545efc06110432ed9503caab8623cc4c20d567e249fe37abf3a2865c6ba8358a370699f3bb917dca2705e85a69fa873e370a125

        Download Submit

      • memory/1628-819-0x0000019356240000-0x0000019356250000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1628-825-0x00000193562A0000-0x00000193562B0000-memory.dmp

        Filesize

        64KB

        Download