MedusaLocker ransomware targets the hospital and healthcare sectors and uses AES and RSA encryption to lock victims’ data. The analysis outlines its techniques for persistence, privilege escalation, service/process termination, shadow copy deletion, network propagation, and practical prevention strategies. #MedusaLocker #UACBypass
Keypoints
- MedusaLocker primarily targets the Hospital and Healthcare industries and uses AES and RSA encryption.
- It checks for a Mutex and creates one if absent to ensure a single instance.
- It detects if it is running with admin privileges and bypasses UAC to elevate privileges.
- It creates a registry entry (HKEY_CURRENT_USERSOFTWAREMDSLK) to designate infected systems.
- It terminates hardcoded services and processes to hinder remediation.
- It deletes shadow copies/backups to disable data recovery and persists by duplicating as svhost.exe or svchostt.exe in AppData Roaming.
- Encryption uses a unique AES key, encrypted with an embedded RSA public key, making decryption dependent on attackers’ private key.
- Network propagation is attempted via enumeration of network shares (NetShareEnum) after encryption.
MITRE Techniques
- [T1112] Modify Registry – It adds the registry key HKEY_CURRENT_USERSOFTWAREMDSLK with the name “self” and data as the application name, designating the system being infected by MDuSaLocker. ‘It adds the registry key HKEY_CURRENT_USERSOFTWAREMDSLK with the name “self” and data as the application name, designating the system being infected by MDuSaLocker.’
- [T1548.002] Bypass User Account Control – If it detects that the process lacks admin privileges, it employs a User Account Control (UAC) bypass technique to attain elevated privileges. ‘If it detects that the process lacks admin privileges, it employs a User Account Control (UAC) bypass technique to attain elevated privileges.’
- [T1486] Data Encrypted for Impact – The ransomware uses AES 256 encryption to lock the victim’s files, creating a unique AES encryption key. This AES key is then encrypted using an embedded RSA public key, resulting in the ciphertext. ‘The ransomware uses AES 256 encryption to lock the victim’s files, creating a unique AES encryption key. This AES key is then encrypted using an embedded RSA public key, resulting in the ciphertext.’
- [T1057] Process Discovery – Ransomware uses CreateToolhelp32Snapshot() to retrieve the running processes. It compares with a predefined list of hardcoded processes. If any of the hardcoded processes are detected as running, the ransomware proceeds to terminate those processes using the TerminateProcess
- [T1489] Service Stop – Like other ransomware, MedusaLocker also terminates specific services by referencing a hardcoded list of services. It compares this list with the currently running services, and if any of the hardcoded services are found to be running, it stops them using the CloseServiceHandle(), as shown in the below fig:
- [T1547.001] Registry Run Keys/Startup Folder – Persistence: Medusa Locker ransomware duplicates its malicious executable as either “svhost.exe” or “svchostt.exe” within the user’s roaming application data directory (%AppData%Roaming) to establish persistence and ensure the malware runs during system start-up, allowing it to continue encrypting files. ‘Persistence: Medusa Locker ransomware duplicates its malicious executable as either “svhost.exe” or “svchostt.exe” within the user’s roaming application data directory (%AppData%Roaming) to establish persistence and ensure the malware runs during system start-up.’
- [T1135] Network Share Discovery – After Encryption, the ransomware uses Windows Network API NetShareEnum to enumerate network share. It processes share names, performs string manipulations, and checks for the presence of “$” in share names. ‘After Encryption, the ransomware uses Windows Network API NetShareEnum to enumerate network share. It processes share names, performs string manipulations, and checks for the presence of “$” in share names.’
Indicators of Compromise
- [Hash] IO – MedusaLocker sample hashes observed: 6da9c76a6e319c17f1d39e0ae2eaf2af, 4ef811b784b985769645e03bc0b9cd24, 61b0906f31ce772130b0ee9c4b86dc92