Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Medusa Locker infections begin with a batch file that creates a scheduled task. Once this scheduled task is run on startup, PowerShell is used to read a text file containing a block of malicious code. This text document contains PowerShell code capable of performing process injection. Additionally, it contained the Base64-encoded ransomware payload. After being injected into a process by the aforementioned scheduled task, the ransomware performs a large number of steps in its infection process. It checks its administrative privileges and, if necessary, performs a UAC bypass using the CMSTP technique. It establishes persistence through scheduled tasks, but instead of using schtasks.exe or at.exe like most malware, it leverages Windows programming APIs. A hardcoded list of services and processes are terminated. Additionally, during the encryption process, the ransomware performs a unique functionality of using Windows Restart Manager to unlock any files still unable to be encrypted due to a running process. WMI, vssadmin, and bcdedit are all used in conjunction to ensure recovery capabilities are prevented. Unlike other ransomware, Medusa Locker performs an additional step of emptying the Recycle Bin. After modifying SMB connection settings, the malware is also able to encrypt files on remote systems via SMB. Encryption is performed using AES-256 with a base64-encoded public key embedded inside the ransomware binary. No method to decrypt the files without paying the demanded ransom is known at this time.
File encryption