Overview

overview

10

Static

static

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows7_x64

Analysis

  • max time kernel
    999s
  • max time network
    994s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-11-2020 06:05

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

  • Size

    200KB

  • MD5

    c2671bf5b5dedbfd3cfe3f0f944fbe01

  • SHA1

    da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1

  • SHA256

    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2

  • SHA512

    256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9

Score
10/10
mountlockerbootkitpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Ransom Note
Your ClientId: /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. Contact us to discuss your next step. http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502c89be06cda603cbe00577a9cc00a153 * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502c89be06cda603cbe00577a9cc00a153". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). If you can`t use the above link, use the email: SloanAlbert@protonmail.com Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible.
Emails

SloanAlbert@protonmail.com

URLs

http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502c89be06cda603cbe00577a9cc00a153

Signatures

  • MountLocker Ransomware

    Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    ransomwaremountlocker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs

    Enables rebooting of the machine without requiring login credentials.

    ransomwarebootkit
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 27 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 8360 IoCs
  • Drops file in Windows directory 1 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 167 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
    "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:500
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden -c $mypid='500';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~259281125.tmp')|iex
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\vssadmin.exe
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1928
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0F759451.bat" "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Windows\SysWOW64\attrib.exe
        attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe"
        3⤵
        • Views/modifies file attributes
        PID:2916
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Modifies service
    • Suspicious use of AdjustPrivilegeToken
    PID:2724
  • C:\Windows\explorer.exe
    "explorer.exe" RecoveryManual.html
    1⤵
      PID:2212
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:2900
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1000
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:3580
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:580
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3156
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0 /state0:0xa3ae5055 /state1:0x41c64e6d
        1⤵
        • Modifies WinLogon to allow AutoLogon
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2224

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Winlogon Helper DLL

      1
      T1004

      Modify Existing Service

      1
      T1031

      Hidden Files and Directories

      1
      T1158

      Privilege Escalation

      Defense Evasion

      File Deletion

      2
      T1107

      Modify Registry

      3
      T1112

      Hidden Files and Directories

      1
      T1158

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      2
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\0F759451.bat
        MD5

        348cae913e496198548854f5ff2f6d1e

        SHA1

        a07655b9020205bd47084afd62a8bb22b48c0cdc

        SHA256

        c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

        SHA512

        799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\~259281125.tmp
        MD5

        4e1a1e3e715c291c71950d2fdc79e2be

        SHA1

        dc2b3d20a9ec88e0d8d75c5097154687acc42983

        SHA256

        acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39

        SHA512

        d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80

        Download Submit
      • C:\Users\Admin\Desktop\RecoveryManual.html
        MD5

        5aa27467ca3568ece3b8c38e7b04a2f8

        SHA1

        72fdb23b9f172d100a65ee481d84b64bba9d47f1

        SHA256

        b49bd969603caffb29256ab43f1282484982dd8370830cd0be122fe9dfe691db

        SHA512

        311364aa996ac22def5eea1b6ed75c8590d33b405c402aceb7474cdd7252ecb6ffe123c310c0177d35f02741e8f79f1f783f64ba6b077426d4d5fdaacbb1ed16

        Download Submit
      • memory/500-2-0x0000000004690000-0x000000000469F000-memory.dmp
        Filesize

        60KB

        Download
      • memory/1928-17-0x0000000000000000-mapping.dmp
        Download
      • memory/1948-7-0x0000000007030000-0x0000000007031000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-16-0x0000000008ED0000-0x0000000008ED1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-9-0x00000000078C0000-0x00000000078C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-10-0x0000000007B10000-0x0000000007B11000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-11-0x0000000006D50000-0x0000000006D51000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-12-0x00000000081B0000-0x00000000081B1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-13-0x0000000008200000-0x0000000008201000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-6-0x00000000071E0000-0x00000000071E1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-15-0x0000000009940000-0x0000000009941000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-8-0x00000000070D0000-0x00000000070D1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-5-0x0000000006A30000-0x0000000006A31000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-18-0x00000000092C0000-0x00000000092C1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-19-0x0000000008FF0000-0x0000000008FF1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-20-0x0000000009FC0000-0x0000000009FC1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1948-3-0x0000000000000000-mapping.dmp
        Download
      • memory/1948-4-0x0000000072FC0000-0x00000000736AE000-memory.dmp
        Filesize

        6.9MB

        Download
      • memory/2916-23-0x0000000000000000-mapping.dmp
        Download
      • memory/3612-21-0x0000000000000000-mapping.dmp
        Download