• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – New LNK Attack Tied to Higaisa APT
June 5, 2020
Rewterz Threat Alert – COVID-19 Phishings Distribute GuLoader Targeting Greek Banks
June 5, 2020

Rewterz Threat Alert – Medusa Locker Ransomware

June 5, 2020

Severity

High

Analysis Summary

Medusa Locker infections begin with a batch file that creates a scheduled task. Once this scheduled task is run on startup, PowerShell is used to read a text file containing a block of malicious code. This text document contains PowerShell code capable of performing process injection. Additionally, it contained the Base64-encoded ransomware payload. After being injected into a process by the aforementioned scheduled task, the ransomware performs a large number of steps in its infection process. It checks its administrative privileges and, if necessary, performs a UAC bypass using the CMSTP technique. It establishes persistence through scheduled tasks, but instead of using schtasks.exe or at.exe like most malware, it leverages Windows programming APIs. A hardcoded list of services and processes are terminated. Additionally, during the encryption process, the ransomware performs a unique functionality of using Windows Restart Manager to unlock any files still unable to be encrypted due to a running process. WMI, vssadmin, and bcdedit are all used in conjunction to ensure recovery capabilities are prevented. Unlike other ransomware, Medusa Locker performs an additional step of emptying the Recycle Bin. After modifying SMB connection settings, the malware is also able to encrypt files on remote systems via SMB. Encryption is performed using AES-256 with a base64-encoded public key embedded inside the ransomware binary. No method to decrypt the files without paying the demanded ransom is known at this time.

MedusaLocker-Figure-30.png

Impact

File encryption

Indicators of Compromise

MD5

  • c4dcfe39b3f3bbed32fbc25ed92d8fd0
  • 9054555c7d931d0b5c96e9b767f4898e

SHA-256

  • e6bd25aec2de3b3e5e3263768da9e20ded49f4fb9edbe34dce2df216478aeea5
  • 11a044c67f6c78cb7c89bdd86c9d247fa82102d0d7f5fe035ff686447a57db31

SHA1

  • 3a16925b44226d8253a14ec8c04ed46deeb7744b
  • b3b4f351cc92b6f436a097d70962878c3fe04767

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.