Procedure examples

Medusa Ransomware has leveraged an encoded list of services that it designates for termination.

Medusa Ransomware has utilized XOR encrypted strings.

Medusa Ransomware has utilized an encoded list of the processes that it detects and terminates.

Medusa Ransomware has launched PowerShell scripts for execution and defense evasion.

Medusa Ransomware has used `cmd.exe` to execute command on an infected host.

Medusa Ransomware has the ability to delete itself after execution. Medusa Ransomware also has the ability to delete itself after execution through the command `cmd /c ping localhost -n 3 > nul & del`.

Medusa Ransomware has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.

Medusa Ransomware has searched for files within the victim environment for encryption and exfiltration. Medusa Ransomware has also identified files associated with remote management services.

Medusa Ransomware has leveraged Windows Native API functions to execute payloads.

Medusa Ransomware has discovered device uptime through `GetTickCount()`.

Medusa Ransomware has identified networked drives.

Medusa Ransomware has decoded XOR encrypted strings prior to execution in memory.

Medusa Ransomware has encrypted files using AES-256 encryption, which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

Medusa Ransomware has the capability to terminate services related to backups, security, databases, communication, filesharing and websites. Medusa Ransomware has also utilized the `taskkill /F /IM <process> /T` command to stop targeted processes and `net stop <process>` command to stop designated services.

Medusa Ransomware has deleted recovery files such as shadow copies using `vssadmin.exe`.

Medusa Ransomware has the capability to detect security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

Medusa Ransomware has created a new PowerShell process using the `CreateProcessA` API.

Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.

Medusa Ransomware has utilized the `ShowWindow` function to hide current window.

Medusa Ransomware has avoided specified files, file extensions and folders to ensure successful execution of the payload and continued operations of the impacted device.

Medusa Ransomware has enumerated logical drives on infected hosts.

Medusa Ransomware has terminated antivirus services utilizing the gaze.exe executable. Medusa Ransomware has also terminated antivirus services utilizing PowerShell scripts.