Overview

overview

10

Static

static

43064ebb9f...00.exe

windows7_x64

10

43064ebb9f...00.exe

windows10_x64

8

Resubmissions

21/04/2021, 05:57

210421-6629fr1gja10

20/04/2021, 23:42

210420-mt2kpcnwbx10

20/04/2021, 23:39

210420-4kmcwg1k3a10

Analysis

  • max time kernel
    127s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    20/04/2021, 23:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00.exe
  • Size 4.5MB
  • Sample210420-mt2kpcnwbx
  • SHA256 43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00
  • MD5 SHA1 SHA512
Score
10/10
mountlockerransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\RecoveryManual.html

Ransom Note
  • Your ClientId: /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. Contact us to discuss your next step. http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c82ec8934d65d09c4b4780f215bbdd154f * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c82ec8934d65d09c4b4780f215bbdd154f". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). If you can`t use the above link, use the email: [email protected] Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible.
URLs

  • http://lhvqpdydwvtgy2ficsvamluobvonnitji5jgpfvc7c5pj6ci35gurjyd.onion/?cid=c7756a52c92cfb896c41800ac9bbe0c82ec8934d65d09c4b4780f215bbdd154f

Signatures

  • MountLocker Ransomware

    Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    ransomwaremountlocker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00.exe
    "C:\Users\Admin\AppData\Local\Temp\43064ebb9fccce989e8a8ebe2e8ee5df154b55f7b94d933e0cf7dba6ac765f00.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "file.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2004
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -windowstyle hidden -c $mypid='1920';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~259275564.tmp')|iex
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:744
          • C:\Windows\SysWOW64\vssadmin.exe
            "C:\Windows\system32\vssadmin.exe" delete shadows /all /Quiet
            4⤵
            • Interacts with shadow copies
            PID:1072
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F7584AA.bat" "C:\Users\Admin\AppData\Local\Temp\file.exe""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:592
          • C:\Windows\SysWOW64\attrib.exe
            attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\file.exe"
            4⤵
            • Views/modifies file attributes
            PID:1196
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:808
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RecoveryManual.html
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:268 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:912

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/268-102-0x00000000004F0000-0x0000000000500000-memory.dmp
          Download

          memory/744-70-0x00000000753B1000-0x00000000753B3000-memory.dmp
          Download

          memory/744-86-0x000000007EF30000-0x000000007EF31000-memory.dmp
          Download

          memory/744-72-0x00000000047C0000-0x00000000047C1000-memory.dmp
          Download

          memory/744-73-0x0000000002450000-0x0000000002451000-memory.dmp
          Download

          memory/744-75-0x0000000000802000-0x0000000000803000-memory.dmp
          Download

          memory/744-74-0x0000000000800000-0x0000000000801000-memory.dmp
          Download

          memory/744-76-0x0000000005260000-0x0000000005261000-memory.dmp
          Download

          memory/744-80-0x0000000005660000-0x0000000005661000-memory.dmp
          Download

          memory/744-85-0x0000000005710000-0x0000000005711000-memory.dmp
          Download

          memory/744-87-0x0000000006250000-0x0000000006251000-memory.dmp
          Download

          memory/744-71-0x0000000001DF0000-0x0000000001DF1000-memory.dmp
          Download

          memory/744-94-0x00000000062E0000-0x00000000062E1000-memory.dmp
          Download

          memory/744-95-0x0000000006300000-0x0000000006301000-memory.dmp
          Download

          memory/1920-68-0x0000000000250000-0x0000000000252000-memory.dmp
          Download

          memory/1920-65-0x0000000000260000-0x000000000026F000-memory.dmp
          Download

          memory/2004-64-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp
          Download