Overview

overview

10

Static

static

10

2024-09-20...er.exe

windows7-x64

10

2024-09-20...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 18:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-20_ed858a19f5881d5b4c1d291fc3c50bde_cobalt-strike_medusa-locker.exe

  • Size

    669KB

  • MD5

    ed858a19f5881d5b4c1d291fc3c50bde

  • SHA1

    2becf1d3b743ecf638568065aeb631653f69d003

  • SHA256

    f6e687b576ad52361379864e8065da6fb698df4ec6e0a1f664670229717eb230

  • SHA512

    7c6c83e63ff207b4957b58f076304724007b0b886388f07142264f516dfcda1d12f73ec8e71bba0cce6ed6d2a31d055c61f5df4bb95442bef88e9c16f1c57906

  • SSDEEP

    12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DOKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWnKrKe

Score
10/10
medusalockerdiscoveryevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\HOW_TO_BACK_FILES.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">17FEDBF9071485639CF98D623B389654C405B6EAF686A57A22C209AA83B6D38720BD5DF06704779F311A7C3AFA0A0EFBDA978A0E573F80E69FFEB9E66A8DDCE6<br>F44BEA8686202E22C7DD571B11E750CC2A0CC336E13D297010827992DB481310E3DC6AC0572F720F4EDA4C88761E8D1044FBA14D3B3B8C583629E765F69B<br>ECA62848E90E0722773AA212DAA7F7E25D4C1710DF7FE1205ECEB64B70D8E49100B6B7E010C6892C9E75ABECC9A183E9A7AF31FE866956138112FCCE86B9<br>D58364E294107DF0D9BBAB6619C8E7A5AC1827930A43D45568C765D1784EA093B38593A4D16A9702DEE2173B1EE7A4F0DAF0791C244631B049B5233CF1EB<br>BD92717D62259D73AEDE4D82C6C92F9DE9C66C7F155F61C7482AD21B26BBC8AC619AF14E3D62B56F2E647C705E571E3BF40025F7E6F0A3A583781A671C97<br>8BABC3AE5B148039C6CB23F2986E264336AA337C0BF69EEBC9F3DD6D30400707E30E97DB4F9A23A0C95E9589437BEA37894C7AE78C21D30934DB514BB175<br>68491AB12F4BD391894E8DEB64E6A104BDD0178F631ECF1313105D220701BB99825525A54D7BA28FAE655156B77730983923F627E7B3204471FF751C939E<br>7414F16266298C10B5885665D4C1D9D897DE9541DF530A34FB98DC9D221D8E532B8A211D0CDCFE9BAA29D09960381A6A5585D5A829B3F79F839869707EBC<br>034FD40B2932EF95A44888497071</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <hr> <b>email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> <p>* <a href<a href<b> </div> </div> </div> <!--tab--> <b> <b> <b> <span style="font-size: 22px"></span> </b><br><br> </b><br> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 1 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Renames multiple (234) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-20_ed858a19f5881d5b4c1d291fc3c50bde_cobalt-strike_medusa-locker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-20_ed858a19f5881d5b4c1d291fc3c50bde_cobalt-strike_medusa-locker.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4088
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4512
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4920
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1912
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svhost.exe
    Filesize

    669KB

    MD5

    ed858a19f5881d5b4c1d291fc3c50bde

    SHA1

    2becf1d3b743ecf638568065aeb631653f69d003

    SHA256

    f6e687b576ad52361379864e8065da6fb698df4ec6e0a1f664670229717eb230

    SHA512

    7c6c83e63ff207b4957b58f076304724007b0b886388f07142264f516dfcda1d12f73ec8e71bba0cce6ed6d2a31d055c61f5df4bb95442bef88e9c16f1c57906

    Download Submit

  • C:\Users\Default\ntuser.dat.LOG2
    Filesize

    536B

    MD5

    80f2b4b4927eef21bed35c94612fc425

    SHA1

    a9e5e2095ccb745dab9c1c90bdc8c62521674b77

    SHA256

    4e30ad6f578eefe9c311d77ab805bf005e57c4a7de53cdc5b10177bd6d15485b

    SHA512

    e777d28648f1dd6379623bf91b8a24d121600abf70da9c914fda59b84fab2f73f2266b3f2f2251129f136c927a3d89da5ff831b93f03052fd9a6da0c8e7f2802

    Download Submit

  • \Device\HarddiskVolume1\HOW_TO_BACK_FILES.html
    Filesize

    4KB

    MD5

    6d4cf19ba8b5920fbdc47eb1346ebc97

    SHA1

    6a97d798b6b7021a60e0bd726dea1bb0e8404a2e

    SHA256

    9fbc2971f2a648b68973ea338d9e5cda07f4cc8e275960dddc1ca3ef40ef494d

    SHA512

    c7bbf5a220083fd0bd4f3ff79f327123d857fa7c2f8196c1e7aca56ffced23d526423791c77c1e03eeffa6210c68218035898254da0d3f1c99407e9dd234252a

    Download Submit