Overview

overview

10

Static

static

10

99a72b5672...30.exe

windows10-2004-x64

10

99a72b5672...30.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a6c0b2bd4b877f5addee572679796c622b41dab5ff93366d7f5c56c000907703
  • Size 291KB
  • Sample260812-rpgrcaaj2w
  • SHA256 a6c0b2bd4b877f5addee572679796c622b41dab5ff93366d7f5c56c000907703
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
medusalockerdefense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • \Device\HarddiskVolume1\HOW_TO_RECOVER_DATA.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">3B4E3A916367768B82C648D14A9C535709B0301866FDFD5A1BD7A83D00371AE4C37879EA3DE9D5ACCAA6E33ADA42875AAC68E5A01341819ABAAC84335A80EA59<br>4EE3D280DE3DAE9352A0AE973590404D6B4DB76386EFB41BA58C0EACFE62F9730C3C6F97F6F6D9E1FFD5427649BCC941433345397FCED8208803478AD2E0<br>87C44F29C309F62183715110D2AB1BE54ED401E632EDD0FDD1C95EF96B17034181B5D052FDE43A30F60A9A9FB0F77D37C50E7F4070B7DCF8ABE944438C68<br>B5D27BD7E31B2DF724EF4EAE5865E6E10A21C12ABA20ED84CCA00AEE0718C18244D845D89AAE39EAD13A449D1442968E4F5351A418CAB9C52781E5925ADC<br>13508A19808330970528FE05419AEAD6D030597CF5E159FB81FF77FBEDCD6CDACE2AE7F20D3404237A23F508B598C959DDCF910AA35A71509958D76495D3<br>8CFD20B1F6F434780B10D04EE6D3C5D0F2E6DCA55BE670F93A93B43EC947FF67B23B0C9E7A2502FBB6ADCA071CD3FCE532FECA0DEFE5F39AEAB899E50DA2<br>E4F5AA26BD9FA792AAED06FF3858AF2D58A936653AE34F9B35D15FBFA3716781F0150C573643D909C5447E9905B6A3D1729A954FB27AC34CB75F084D5B5D<br>F98AC312CA995A9F91E8821B633A393E82BAE84F808E0197F76E708FB0E50C3F34DF134A03AE8BF854F696AC1B8C555CD214A98E5E30BE93C18099B9A458<br>06CC81828B021FB9E626DB375499</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

  • C:\Recovery\WindowsRE\HOW_TO_RECOVER_DATA.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">CBD335727E2C353F2C6564BC74E015D6A96F939234D4386FF91B5C0842C1E96A0CA56E93329616A97C8FBAD30DDF76FD20D99D73ADBA6C154B24658EC110A0A0<br>DB9EB295FCE8F672431D53F2D8F59A3E415733EA63D24C6E22EA37F55A907C2D17988B2CFCD75AE8A9F70BE3F45B39145C1B79A0B745BA5105717A82A11F<br>7262A6FE25C56B69A37B3F501D8608AEEB5C6E84A0DF504B18A98BB6AF8886A1E7A59CA0983DAB137A1842594021927A96EEB86F8BA1030D02DE1686BACC<br>FC75A1CBF9A8946E66A7AF3CF485F731473EC0D87F56F338A498E35BC70257438C0EDEEB1977C1013DC308EF4D250A124CD47A37DA231FB7B55BEED7FF4C<br>267675814B132EA53737ED304A4671ED9EDC57B4A3A2C9CDAD9EA109311F7CFED07B669A5B0C8DC96C9B902F1CEDC8B652291AEF3ACEB2E74629C1751AA3<br>BAA170456C62EC2C7D2CAD1D58E3B51F3078C9F19A9384A00C40F0F43ABE55CF83DC4D3570DB8E8F88AFD90C12D66D393B8AD9E84EE0047D4FF2F4AA4072<br>0F12ACA75A9DA0E9604BB8634969DF6771BEA042E62B1D1DA1002D3C4D80A84435E0A569B49E0AB86C8752AE5C392B460822E47945FF56F2E038D3641F16<br>B81292AAD7E909F3DF86134C3DBB973B1F1F67F798D197295043B8EFAE86A3C4D68724ADAF5DF36D8E58F9C018326BECA35DADE38C68BFBC5F1EC255267F<br>0C6112FD3E61051157C7C9FA5976</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target
      99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30.exe
    • Size 669KB
    • SHA256 99a72b56725196298391f3d52b8536b018aa8b60d97c443161e912430079ed30
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoverymedusalockerransomwarespywarestealertrojan

    • Family: MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      defense_evasiontrojan

    • Renames multiple (208) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks