Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-05-2021 16:51
General
-
Target
30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.bin.msi
-
Size
112KB
-
MD5
ce3969ab935f0f5b1301cd70d2e59696
-
SHA1
e70d3341a6e2cc8ae0f140075837ceac4453b947
-
SHA256
30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83
-
SHA512
20998be53a994d7adab2b71bafccec1eeb93e356965582161fa1fccea023fbf62b0145adf5e0621118f00a4ea12a71fbb5de2fdd129d92879502a5a3da019a36
Malware Config
Signatures
-
Detected Mount Locker ransomware 2 IoCs
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 9 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies data under HKEY_USERS 5 IoCs
-
Modifies registry class 28 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.bin.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F2897A4029FB7F545273D51B36197FA22⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0F745692.bat" "C:\Windows\Installer\MSI30AD.tmp""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -s -r -h "C:\Windows\Installer\MSI30AD.tmp"4⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F745692.batMD5
348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
-
C:\Windows\Installer\MSI30AD.tmpMD5
0aacf2c41ba9b872a52055ffcaeaef15
SHA1c09b509699aeef71f3e205d53c5f4ff71cb48570
SHA25631630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585
SHA512d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2MD5
6605f87b31bdd763e289f98ec2fa3ca3
SHA19a4a425d4fb13fef672cba1d1772459f3587268b
SHA2562f1a7d01ad8685198584cf4722f76c301ae3fffab6226f715d89203267c0d223
SHA5129c3e2b93407ea38c7e42fdb59361d9674d7909d82af8ced23cd6c44d05826c706d6286710c92aa233209be907f4dc548775488802c95ea46f8c2d444b390a6cf
-
\??\Volume{266d1ca4-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{a8e05123-f565-4984-9cf0-d600f4e81e8d}_OnDiskSnapshotPropMD5
357568a628003b60c93f1d76a4274928
SHA10d123600707960b524ae6e1c619e0913f7fb725f
SHA2567f6e9583aba7710b971bdae33ed1a292392ba81d757b10045143a3889d906352
SHA51259d9ab5def1ca25d175bc4ffe89179e27a72d73f7c70c65a67b4021aed596a39efc17534a7af93fa658fa159a26d935caa4b9a0a095213b8d75b7a0db90a433d
-
\Windows\Installer\MSI30AD.tmpMD5
0aacf2c41ba9b872a52055ffcaeaef15
SHA1c09b509699aeef71f3e205d53c5f4ff71cb48570
SHA25631630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585
SHA512d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec
-
memory/2128-127-0x0000000000000000-mapping.dmp
-
memory/2464-126-0x0000000000000000-mapping.dmp
-
memory/2708-119-0x0000000000000000-mapping.dmp
-
memory/3600-118-0x0000000000000000-mapping.dmp
-
memory/4176-129-0x0000000000000000-mapping.dmp