{"id":92147,"date":"2023-10-13T19:29:52","date_gmt":"2023-10-13T13:59:52","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=92147"},"modified":"2023-10-13T19:29:52","modified_gmt":"2023-10-13T13:59:52","slug":"medusalocker-ransomware-an-in-depth-technical-analysis-and-prevention-strategies","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/medusalocker-ransomware-an-in-depth-technical-analysis-and-prevention-strategies\/","title":{"rendered":"MedusaLocker Ransomware: An In-Depth Technical Analysis and Prevention Strategies"},"content":{"rendered":"

Our recent research has highlighted the presence of the MedusaLocker ransomware, which first surfaced in mid-2019. Its primary targets are the Hospital and Healthcare industries. MedusaLocker employs AES and RSA encryption techniques to encrypt victims’ data.<\/p>\n

Technical Analysis<\/h3>\n

At the start, it performs a check for the presence of a Mutex. If the Mutex does not exist, it proceeds to create the Mutex using the CreateMutexW() function, as shown in the below fig:<\/p>\n

\"\"
Creating the Mutex<\/figcaption><\/figure>\n

MedusaLocker checks to determine whether the current process runs with administrative privileges. If it detects that the process lacks admin privileges, it employs a User Account Control (UAC) bypass technique to attain elevated privileges.<\/p>\n

\"\"
Elevating Administrator Privelege<\/figcaption><\/figure>\n
\"\"
UAC Bypass<\/figcaption><\/figure>\n

It adds the registry key HKEY_CURRENT_USER\\SOFTWARE\\MDSLK\\ with the name \u201cself\u201d and data as the application name, designating the system being infected by MDuSaLocker.<\/p>\n

\"\"<\/p>\n

\"\"
Registry Entry<\/figcaption><\/figure>\n

Disables the Services and Terminates the Processes:<\/h3>\n

Like other ransomware, MedusaLocker also terminates specific services by referencing a hardcoded list of services. It compares this list with the currently running services, and if any of the hardcoded services are found to be running, it stops them using the CloseServiceHandle(), as shown in the below fig:<\/p>\n

\"\"
Disables the Running Space<\/figcaption><\/figure>\n

List of Hardcoded services:<\/em><\/strong><\/p>\n

wrapper, DefWatch, ccEvtMgr, ccSetMgr, SavRoam, sqlservr, sqlagent, sqladhlp, Culserver, RTVscan, sqlbrowser, SQLADHLP, QBIDPService, Intuit.QuickBooks.FCS, QBCFMonitorService, sqlwriter, msmdsrv, tomcat6, zhudongfangyu, SQLADHLP, vmware-usbarbitator64, vmware-converter, dbsrv12, dbeng8<\/p>\n

Ransomware uses CreateToolhelp32Snapshot() to retrieve the running processes. It compares with a predefined list of hardcoded processes. If any of the hardcoded processes are detected as running, the ransomware proceeds to terminate those processes using the TerminateProcess, as shown in the below fig:<\/p>\n

\"\"
Terminating the Running Process<\/figcaption><\/figure>\n

List of Hardcoded Process:<\/strong><\/em><\/p>\n

wxServer.exe, wxServerView, sqlservr.exe, sqlmangr.exe, RAgui.exe, supervise.exe, Culture.exe, RTVscan.exe, Defwatch.exe, sqlbrowser.exe, winword.exe, QBW32.exe, QBDBMgr.exe, qbupdate.exe, QBCFMonitorService.exe, axlbridge.exe, QBIDPService.exe, httpd.exe, fdlauncher.exe, MsDtSrvr.exe, tomcat6.exe, java.exe, 360se.exe, 360doctor.exe, wdswfsafe.exe, fdlauncher.exe, fdhost.exe, GDscan.exe, ZhuDongFangYu.exe<\/p>\n

Deleting Shadow Copy and Disabling Data Recovery:<\/h3>\n

MedusaLocker uses hardcoded commands to remove backups, delete the shadow copy, etc.<\/p>\n

\"\"
Hardcoded Commands<\/figcaption><\/figure>\n

PERSISTENCE<\/h3>\n

Medusa Locker ransomware duplicates its malicious executable as either “svhost.exe” or “svchostt.exe” within the user’s roaming application data directory (%AppData%\\Roaming) to establish persistence and ensure the malware runs during system start-up, allowing it to continue encrypting files.<\/p>\n

\"\"
Persistence Mechanism<\/figcaption><\/figure>\n

ENCRYPTION<\/h3>\n

In the encryption process like other ransomware, it also excludes the list of files, folders, and hardcoded extensions from the encryption process.<\/p>\n

The ransomware uses both AES+RSA encryption keys. The ransomware employs AES 256 encryption to lock the victim’s files, creating a unique AES encryption key. This AES key is then encrypted using an embedded RSA public key, resulting in the ciphertext. The RSA encryption ensures that without the corresponding private key, decryption of the AES key is practically impossible.<\/p>\n

The AES key is essential for unlocking the victim’s files, making access contingent on obtaining the private key from the attackers.<\/p>\n

\"\"
RSA-KEY<\/figcaption><\/figure>\n
\"\"
Iteration of Drive<\/figcaption><\/figure>\n

The ransomware tries to retrieve the logical drives using the API call GetLogicalDrives to encrypt the system.<\/p>\n

\"\"
Calling Encryption Function<\/figcaption><\/figure>\n

It drops the Ransom note in an HTML file which contains the personal ID, Tor link, and emails of attackers.<\/p>\n

\"\"
Ransom Note Dropped by Medusa Ransomware<\/figcaption><\/figure>\n
\"\"
Encrypted Files with Extension “L54”<\/figcaption><\/figure>\n

Network Infection:<\/h3>\n
\"\"
Network Enumeration<\/figcaption><\/figure>\n

After Encryption, the ransomware uses Windows Network API NetShareEnum to enumerate network share. It processes share names, performs string manipulations, and checks for the presence of “$” in share names.<\/p>\n

It seeks to spread to other devices on the same network, attempting to infect them like a digital contagion.<\/p>\n

How do we prevent such kinds of attacks?<\/strong><\/h3>\n

\u00b7 Do not download and open any attachments from unknown sources.<\/p>\n

\u00b7 Avoid clicking on any unverified link. The leading cause of ransomware attacks is clicking on untrusted links and attachments.<\/p>\n

\u00b7 Regularly update your operating system, applications, and software to fix known vulnerabilities, often exploited by ransomware.<\/p>\n

\u00b7 Back up your data so that it can be recovered in case of a ransomware attack.<\/p>\n

Conclusion<\/h3>\n

Medusa Locker ransomware is a notorious strain of malicious software that encrypts victims’ files, rendering them inaccessible until a ransom is paid. This dangerous malware has caused widespread damage to individuals and organizations alike. As cybercriminals continually evolve their tactics, the threat of Medusa Locker remains ever-present.<\/p>\n

Quick Heal Protection:<\/h3>\n

\u00b7 Generic Signature names:<\/p>\n

\u00b7 Ransom.Medusa.S27286013<\/p>\n

\u00b7 Ransom.Medusa.S13913779<\/p>\n

\u00b7 Ransom.MedusaLock.S9836707<\/p>\n

\u00b7 Trojan.YakbeexMSIL.ZZ4<\/p>\n

\u00b7 Ransom.Medusa.S10272352<\/p>\n

\"\"<\/p>\n

IOCs:<\/h3>\n

6da9c76a6e319c17f1d39e0ae2eaf2af<\/p>\n

4ef811b784b985769645e03bc0b9cd24<\/p>\n

61b0906f31ce772130b0ee9c4b86dc92<\/p>\n

 <\/p>\n

Author – Soumen Burma<\/strong><\/p>\n

Co-Author – Vaibhav Krushna Billade<\/strong><\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Our recent research has highlighted the presence of the MedusaLocker ransomware, which first surfaced in mid-2019. Its primary targets are the Hospital and Healthcare industries. MedusaLocker employs AES and RSA encryption techniques to encrypt victims’ data. Technical Analysis At the start, it performs a check for the presence of a Mutex. If the Mutex does […]<\/p>\n","protected":false},"author":108,"featured_media":92149,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1660,164,289,910,6,1],"tags":[1922],"class_list":["post-92147","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-advisory","category-cyber-crime","category-cyber-safety","category-ransomware","category-tips","category-uncategorized","tag-quick-heal-ransomware-cybersecurity-hacking-ransomwareprevention-threatintelligence"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/92147"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/108"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=92147"}],"version-history":[{"count":5,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/92147\/revisions"}],"predecessor-version":[{"id":92170,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/92147\/revisions\/92170"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/92149"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=92147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=92147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=92147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}