Analysis
-
max time kernel
16s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-05-2021 16:59
Static task
static1
Behavioral task
behavioral1
Sample
187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe
-
Size
47KB
-
MD5
4caacde2df87777bca7860018f37edec
-
SHA1
ef99230e52d5f56a3681bf3155fe7c4b56baeb84
-
SHA256
187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b
-
SHA512
315f67986a0c5cc9ac2275f757671982dff7f3edc8be1d1a25920c5a481a089face523cbbf333d9edcf3838d73e08bfa12aae8318a9256c1c468c55a12482fab
Score
10/10
Malware Config
Signatures
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\InitializeStep.tif => \??\c:\Users\Admin\Pictures\InitializeStep.tif.ReadManual.6E962680 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Pictures\RemoveStart.tiff 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File renamed C:\Users\Admin\Pictures\RemoveStart.tiff => \??\c:\Users\Admin\Pictures\RemoveStart.tiff.ReadManual.6E962680 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe -
Deletes itself 1 IoCs
pid Process 912 cmd.exe -
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created \??\c:\Program Files (x86)\RecoveryManual.html 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File created \??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RecoveryManual.html 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe File created \??\c:\Program Files\RecoveryManual.html 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.6E962680\shell\Open 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.6E962680\shell\Open\command\ = "explorer.exe RecoveryManual.html" 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.6E962680\shell\Open\command 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.6E962680 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.6E962680\shell 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1420 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe 1420 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeRestorePrivilege 1420 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1420 wrote to memory of 912 1420 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe 30 PID 1420 wrote to memory of 912 1420 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe 30 PID 1420 wrote to memory of 912 1420 187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe 30 PID 912 wrote to memory of 1676 912 cmd.exe 32 PID 912 wrote to memory of 1676 912 cmd.exe 32 PID 912 wrote to memory of 1676 912 cmd.exe 32 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1676 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe"C:\Users\Admin\AppData\Local\Temp\187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F743E67.bat" "C:\Users\Admin\AppData\Local\Temp\187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\187610fb06cc60c73c0062b593c5fe3ba29e0436e396969feb9ed25391ff7e8b.bin.exe"3⤵
- Views/modifies file attributes
PID:1676
-
-