Medusa Locker infections begin with a batch file that creates a scheduled task. Once this scheduled task is run on startup, PowerShell is used to read a text file containing a block of malicious code. This text document contains PowerShell code capable of performing process injection. Additionally, it contained the Base64-encoded ransomware payload. After being injected into a process by the aforementioned scheduled task, the ransomware performs a large number of steps in its infection process. It checks its administrative privileges and, if necessary, performs a UAC bypass using the CMSTP technique. It establishes persistence through scheduled tasks, but instead of using schtasks.exe or at.exe like most malware, it leverages Windows programming APIs. A hardcoded list of services and processes are terminated. Additionally, during the encryption process, the ransomware performs a unique functionality of using Windows Restart Manager to unlock any files still unable to be encrypted due to a running process. WMI, vssadmin, and bcdedit are all used in conjunction to ensure recovery capabilities are prevented. Unlike other ransomware, Medusa Locker performs an additional step of emptying the Recycle Bin. After modifying SMB connection settings, the malware is also able to encrypt files on remote systems via SMB. Encryption is performed using AES-256 with a base64-encoded public key embedded inside the ransomware binary. No method to decrypt the files without paying the demanded ransom is known at this time.