General
-
Target
a7b4ded56a745d078dfc02c6302d136e.bin
-
Size
201KB
-
Sample
241214-cd5lpsspev
-
MD5
96ebf3d7b8a914b113276ff6e3c2f15d
-
SHA1
666d56a182225667f132ca7971c821e68bde02b5
-
SHA256
9e0723c997227302cf234f9ae3888b0b18a4a1ec892ecab86aad3279ca455ee2
-
SHA512
d549e8ada87f0c1f051de180158f1743b99882478c3b9647a629384c733bb1d7610faf7815c9a4dc0b72ede212dccb1263e846084a06dede64ae03862d4b1123
-
SSDEEP
6144:q/wRIQvIVaQS2qe1hLcQQbNHP4DB+n1Mlaq+BT79e6X:q/BQvqnS2hwhcM1mR+BT7nX
Static task
static1
Behavioral task
behavioral1
Sample
13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
Resource
win11-20241007-en
Malware Config
Extracted
C:\How_to_back_files.html
medusalocker
Targets
-
-
Target
13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
-
Size
422KB
-
MD5
a7b4ded56a745d078dfc02c6302d136e
-
SHA1
20b7e3930741e1ab3ab0f2f74617062b47fffbd8
-
SHA256
13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3
-
SHA512
0f3320c525141c3eea4ae28a199327f28784fa5f53f81b8abfeb2d5ae620286fdf1b60def07db8d256623f255f8ebd18c06b5880d423e58477686fb4cda79ea5
-
SSDEEP
6144:MTqhlztbElkd+s0zyykmkkES0J2txMLVesCjuwptsOXNZcX9PNCFR09KKPOeFhbb:RhDdkybr/J2tx2VeFusZXQJhkeFhbb
-
Medusalocker family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (167) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1