Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
241212-x1wyaswqbq_pw_infected.zip
-
Size
320KB
-
Sample
241212-x9sbgavnb1
-
MD5
cf1efdb811c5d30413031e5dbaec4591
-
SHA1
75593f0252ce78abcbf5e85651bba565f428f52b
-
SHA256
9b0853199777b37f5aa0f05a66ab17c3cdc2051aaf5d006f7638b47aff454665
-
SHA512
392a674a8007e94f1c4aa1a803b2a7c2b0d371756e931b2ec9cccb22bb72c9ca3f4603b2d0cedcc866596e912af794ad28c131ec128cef236785cf3d01209c00
-
SSDEEP
6144:jQOI5/IoKoLAxSsIWJnQQNbEs4VDv4d2FOdREzOFRCvu+RDk:jpIuofLUSaJt1h+v4dh7tRSg
Static task
static1
Behavioral task
behavioral1
Sample
4d4df87cf8d8551d836f67fbde4337863bac3ff6b5cb324675054ea023b12ab6.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\$Recycle.Bin\!!!READ_ME_MEDUSA!!!.txt
http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/
http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/227098164ef1fdb119ef537986bbdf24
Targets
-
-
Target
4d4df87cf8d8551d836f67fbde4337863bac3ff6b5cb324675054ea023b12ab6
-
Size
624KB
-
MD5
84b88ac81e4872ff3bf15c72f431d101
-
SHA1
0823d067541de16325e5454a91b57262365a0705
-
SHA256
4d4df87cf8d8551d836f67fbde4337863bac3ff6b5cb324675054ea023b12ab6
-
SHA512
185691b0103669c5aa25b22c36f29ddb66f074e0f2e3ae6a36ed8917c35f1fba71fba65c11c3211ce64f6c5919ac879ce0fdcc4dddae420cbecf40711dff1860
-
SSDEEP
12288:V4eCA30wfnlxvaUwZNf6qYID7ZJuIQOsknZh20QyCkje0ZM7qgbGKTO7muYpralU:3C8valgsDyfSBKXyMUkW2LILGBm3IzPB
-
Medusa Ransomware
Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.
-
Medusaransomware family
-
Renames multiple (8240) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1