Overview

overview

10

Static

static

3

recovery42.exe

windows10-ltsc 2021-x64

10

recovery42.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    recovery42.exe

  • Size

    419KB

  • Sample

    241026-varvjstpck

  • MD5

    68e664c654bcf9d558fb7b4f8da1f28d

  • SHA1

    9deb213f58e48725bcc7974460b5e22cc3866cc1

  • SHA256

    cb03c1677c165261557f0710ddc2e39790acac48ef038c71358ab5ad4f366cca

  • SHA512

    5099414230ceb6c2903085f83f0cd267d7d9362f3c591681979119e52add81c31b032d95f477f7dc503d25da10a9e486b430336a58289b8297e1d79d190ab596

  • SSDEEP

    6144:4CmPvkrISw8ZMQsFMFEXmtT+n4CQi2oD9HoZwIYaTR/dXszI2lUC40:L3W6MoFlV+n4CQRoD9IygT/L+

Score
10/10
medusalockerdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\USERS\PUBLIC\DESKTOP\HOW_TO_BACK_FILES.HTML

Family

medusalocker

Ransom Note
Your personal ID: Yu4S9Ld8euarCjmdGXLexQzRgUaK50iQ05SJb/Rtao4X3YAt97UmpzqhZhD6gV/dWoZSMuLgDbKt71IMod8GAYumdfYmTYa1E2Dkjk3Ie4wklhCpHuZqbPFJciDbeHjdbQiOpVpSjAHzRFlC4ic/M4IB9WenFGzTtyXo5Q0xJMOu8atKxf9ePJjNI4e48y9/9T4/pLi6/rphPF3A6usG8iLWil7hEB4aUvftepnr2rUK4f0Q9qdBaEo7yA1+i++oOfASvr7PMWlM1UwIUxf1Okdk+ZO95Z8IYjELqPs7HKu2wK4HhTZ9XHM4BwS8UY2piyS1PwOMnfs4Vuzhy3HzxcGHeZPeUD38OQ+SZA3Wn41+yIetk6STdAvMB+8zIHZKbjKpDjgFjlI1g0dFx23w29mCi5VsOYSG7oJVFQi3fZu0yYuUda3MRqyzMxh85bwhEsWE4AlPjY0GZITIC0dWLkT+xegHRTQkG/3bBYLivbLjikFVl3beuvvWMWFLnHZS/EK+Yxgg+JnNhKOk/COGH4j77jtQLQTmZSmm8V5+vXxMSLhTDLc4iyVjy2Um4psT5pEwBZDSEG8wU5Ec37xwqzV1wPuoF6s4Qpo/tbeYRw+jTdIN1G2ORE9kX9WrWBqLGVQ1ySPstk7V3E0hm2gNNZshFB9v7XUayGM4I/tUiWUF5UdCXGIo8c0zh3PBetDNmoYnmwBIy90w9cXKu1lSwNPqUw1FBGwcSAI7weqz4lX3rcPzCdGauKw49Ily2rLM3zU7u3MOoSs5Kw0Mpp87xqc1WO8WTOz17cykHhRXamem2blV7KJtov92MxUQBCTKKnFnE1v1SjF82MXDTkoL6/72wY3imtsPN6aSNTh14RNMT0y0v2HIXelJzo8SNJx9pCf+vv364Zra72suuF2YAK8CYGOCvJ3vkbV9vQR9HXTdfD9xZg2yjTd7p71CiBUuITuN+w92NftUn6IXSqLfmFvCjp7R4Ap0z0GWytzLQ4wsxyzwIxVRwf/9/nS0Eys1TiULxPv01kHzm1Kw36gA9RR1zMmJMP4aExX2TGOafX0Abh139DqWvDgdAxk652Bcd7WgNKQ7pJfhn4ip28oEci13sWYIKJYKjgFd2Hb8RXlnEtXLrpOwgommm0F6ueC1KgJYqS1cqE1UlzsmUlKAiGfI3SY36+a2Oy0Ez/eS0Qe07x/nxmPsKmdl7fSKyWffAh2vRTJwKjWfhTll/fhWTWJqhSl+s3CmOOvPP3uEff/qCEu5yS1Rcyroz+t0VV2J3EBVLmoBpwS+O2EU89nqKE5adtsJZROI8DdY5inLaPtBY2bie/tIMlFHxivPSjN95f0RqfHzf9hPKEzkwSoDiTZRguuYy5tc83bPQg4tafRVXaFlihOBHdbxgDFc7FE9mRgMjwvSgZQGtec0kV4XyNL+qlS5DSBmuxj6x9IxOH6ZoNSLtGD53WRtb1H6fRddXGx9YKH5yBZKCbe/LuEHtuEONejZ+8koYL34RJTQQGjGoEc9IRcLK1SqkscN28F2pyasOKYNMlgalAhuEjR4r8W71YlcygMToVObWYsQDQLkJLkOLcayLstThg6mHobRs2B3Ew/dX84RqlIt/CEI6VJMTRga+XrrozW3Lkj0sOd0nY8eJwH7WANgsdJ/uDp8ZSv/55I29q+j3J2Xl5EwKjcsYSlqmPLsNKY7SS+DZyc= /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. * Tor-chat to always be in touch: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Targets

    • Target

      recovery42.exe

    • Size

      419KB

    • MD5

      68e664c654bcf9d558fb7b4f8da1f28d

    • SHA1

      9deb213f58e48725bcc7974460b5e22cc3866cc1

    • SHA256

      cb03c1677c165261557f0710ddc2e39790acac48ef038c71358ab5ad4f366cca

    • SHA512

      5099414230ceb6c2903085f83f0cd267d7d9362f3c591681979119e52add81c31b032d95f477f7dc503d25da10a9e486b430336a58289b8297e1d79d190ab596

    • SSDEEP

      6144:4CmPvkrISw8ZMQsFMFEXmtT+n4CQi2oD9HoZwIYaTR/dXszI2lUC40:L3W6MoFlV+n4CQRoD9IygT/L+

    Score
    10/10
    medusalockerdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • Medusalocker family

      medusalocker

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (185) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

4
T1490

Tasks