Rewterz Threat Alert – Medusa Locker Ransomware

Severity

High

Analysis Summary

Medusa Locker infections begin with a batch file that creates a scheduled task. Once this scheduled task is run on startup, PowerShell is used to read a text file containing a block of malicious code. This text document contains PowerShell code capable of performing process injection. Additionally, it contained the Base64-encoded ransomware payload. After being injected into a process by the aforementioned scheduled task, the ransomware performs a large number of steps in its infection process. It checks its administrative privileges and, if necessary, performs a UAC bypass using the CMSTP technique. It establishes persistence through scheduled tasks, but instead of using schtasks.exe or at.exe like most malware, it leverages Windows programming APIs. A hardcoded list of services and processes are terminated. Additionally, during the encryption process, the ransomware performs a unique functionality of using Windows Restart Manager to unlock any files still unable to be encrypted due to a running process. WMI, vssadmin, and bcdedit are all used in conjunction to ensure recovery capabilities are prevented. Unlike other ransomware, Medusa Locker performs an additional step of emptying the Recycle Bin. After modifying SMB connection settings, the malware is also able to encrypt files on remote systems via SMB. Encryption is performed using AES-256 with a base64-encoded public key embedded inside the ransomware binary. No method to decrypt the files without paying the demanded ransom is known at this time.

Impact

File encryption

Indicators of Compromise

MD5

• c4dcfe39b3f3bbed32fbc25ed92d8fd0
• 9054555c7d931d0b5c96e9b767f4898e

SHA-256

• e6bd25aec2de3b3e5e3263768da9e20ded49f4fb9edbe34dce2df216478aeea5
• 11a044c67f6c78cb7c89bdd86c9d247fa82102d0d7f5fe035ff686447a57db31

SHA1

• 3a16925b44226d8253a14ec8c04ed46deeb7744b
• b3b4f351cc92b6f436a097d70962878c3fe04767

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.