Analysis
-
max time kernel
30s -
max time network
39s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-05-2021 13:02
Static task
static1
Behavioral task
behavioral1
Sample
3808f21e_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3808f21e_by_Libranalysis.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
3808f21e_by_Libranalysis.exe
-
Size
66KB
-
MD5
3808f21e56dede99bc914d90aeabe47a
-
SHA1
93cc73149d4bb34830a2cb2a3047e9267b9e3080
-
SHA256
4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1
-
SHA512
4ae55145cca3a6f1ed3feff5b2bd38121e37c4cc528e08d5de771bcc4855994560bfc8c22898d73c5b259e37d2dc803615b8f6ec859e53918bd7a1ffee9316b3
Score
10/10
Malware Config
Signatures
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ApproveExport.tiff => \??\c:\Users\Admin\Pictures\ApproveExport.tiff.ReadManual.F638D8A0 3808f21e_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\BackupClose.crw => \??\c:\Users\Admin\Pictures\BackupClose.crw.ReadManual.F638D8A0 3808f21e_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\BlockRevoke.crw => \??\c:\Users\Admin\Pictures\BlockRevoke.crw.ReadManual.F638D8A0 3808f21e_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\GetSkip.raw => \??\c:\Users\Admin\Pictures\GetSkip.raw.ReadManual.F638D8A0 3808f21e_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\WatchConvert.tiff => \??\c:\Users\Admin\Pictures\WatchConvert.tiff.ReadManual.F638D8A0 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Pictures\ApproveExport.tiff 3808f21e_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\EnableReset.tif => \??\c:\Users\Admin\Pictures\EnableReset.tif.ReadManual.F638D8A0 3808f21e_by_Libranalysis.exe File renamed C:\Users\Admin\Pictures\UpdateStart.tif => \??\c:\Users\Admin\Pictures\UpdateStart.tif.ReadManual.F638D8A0 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Pictures\WatchConvert.tiff 3808f21e_by_Libranalysis.exe -
Deletes itself 1 IoCs
pid Process 1864 cmd.exe -
Drops desktop.ini file(s) 32 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Music\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini 3808f21e_by_Libranalysis.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini 3808f21e_by_Libranalysis.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created \??\c:\Program Files\RecoveryManual.html 3808f21e_by_Libranalysis.exe File created \??\c:\Program Files (x86)\RecoveryManual.html 3808f21e_by_Libranalysis.exe File created \??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RecoveryManual.html 3808f21e_by_Libranalysis.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.F638D8A0\shell 3808f21e_by_Libranalysis.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.F638D8A0\shell\Open 3808f21e_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.F638D8A0\shell\Open\command\ = "explorer.exe RecoveryManual.html" 3808f21e_by_Libranalysis.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.F638D8A0\shell\Open\command 3808f21e_by_Libranalysis.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.F638D8A0 3808f21e_by_Libranalysis.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1996 3808f21e_by_Libranalysis.exe 1996 3808f21e_by_Libranalysis.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1996 3808f21e_by_Libranalysis.exe Token: SeDebugPrivilege 1996 3808f21e_by_Libranalysis.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1864 1996 3808f21e_by_Libranalysis.exe 27 PID 1996 wrote to memory of 1864 1996 3808f21e_by_Libranalysis.exe 27 PID 1996 wrote to memory of 1864 1996 3808f21e_by_Libranalysis.exe 27 PID 1864 wrote to memory of 1720 1864 cmd.exe 29 PID 1864 wrote to memory of 1720 1864 cmd.exe 29 PID 1864 wrote to memory of 1720 1864 cmd.exe 29 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1720 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3808f21e_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\3808f21e_by_Libranalysis.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F74F824.bat" "C:\Users\Admin\AppData\Local\Temp\3808f21e_by_Libranalysis.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\3808f21e_by_Libranalysis.exe"3⤵
- Views/modifies file attributes
PID:1720
-
-