mountlocker | 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99

General

Target
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Size 66KB
Sample211129-nlhyfscaej
SHA256 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99
MD5 2c26b319e378755596f0ac6d293798c8
SHA1 280a4cfcf5dd87898c3731b680efe061bdb7a9fe
SHA512 0c2b53a3fed1dbbae64e7f1e7c17a89b5dc607ba40caecd5496e18ffd84cdad844e926742d9fc82a715d6e8b01a1c483d97d54f5be1f2d6997107946f2a3fe4b
MD5 SHA1 SHA512

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

\??\c:\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> acc47d8e8c2a4ba5c4c325fca35d0ae42b956c0fd8b260d9eb0e40e1d5779840 </pre> <hr/> If you are here, you want to know what happened. We infiltrated your network, controlled it for a while, examined your data, downloaded sensitive information and finally encrypted your computers. Your files are safe, but encrypted. Any attempt to decrypt files with third-party software will permanently corrupt content. What now? We advise you to be in touch and start negotiations, otherwise your confidential data will be published on few our news sites and promoted in all possible ways. Data publication and even the fact of this leak for sure will lead to significant losses for your company: <ul> <li>government fines <li>lawsuits and as a result legal claims payments <li>additional expenses on law services <li>data recovery </ul> Also you shouldn't underestimate huge damage for your reputation, which can cause crash of equity prices, clients withdrawal and other negative consequences. But don't panic! We are doing business, not war. We can unlock your data and keep everything in secret. All, what we want is a ransom. If we can reach an agreement, you also get: <ul> <li>security report <li>full file tree of compromised data <li>downloaded data unrecoverable deletion <li>support with unlocking and network protection advice. </ul> How can you contact us? Visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons. <a href="http://evl425tkt4hkwryyplvqu6bn6slfow3fa4xwgvwe5t4zf6gizs3ewuyd.onion/?cid=acc47d8e8c2a4ba5c4c325fca35d0ae42b956c0fd8b260d9eb0e40e1d5779840">http://evl425tkt4hkwryyplvqu6bn6slfow3fa4xwgvwe5t4zf6gizs3ewuyd.onion/?cid=acc47d8e8c2a4ba5c4c325fca35d0ae42b956c0fd8b260d9eb0e40e1d5779840</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> Follow the instructions to open the link: <ol> <li>Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor Project website. <li>Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. <li>Now you have Tor browser. In the Tor Browser open "http://evl425tkt4hkwryyplvqu6bn6slfow3fa4xwgvwe5t4zf6gizs3ewuyd.onion/?cid=acc47d8e8c2a4ba5c4c325fca35d0ae42b956c0fd8b260d9eb0e40e1d5779840". <li>Start a chat and introduce yourself (Company name and your position). </ol> Password field should be blank for the first login. You can ask an operator to set password later. </body> </html>

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ConnectDeny.tif => \??\c:\Users\Admin\Pictures\ConnectDeny.tif.ReadManual.F30D4911	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File renamed	C:\Users\Admin\Pictures\InitializeTest.crw => \??\c:\Users\Admin\Pictures\InitializeTest.crw.ReadManual.F30D4911	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File renamed	C:\Users\Admin\Pictures\RegisterUnblock.png => \??\c:\Users\Admin\Pictures\RegisterUnblock.png.ReadManual.F30D4911	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File renamed	C:\Users\Admin\Pictures\ResolveSync.png => \??\c:\Users\Admin\Pictures\ResolveSync.png.ReadManual.F30D4911	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File renamed	C:\Users\Admin\Pictures\UninstallPublish.crw => \??\c:\Users\Admin\Pictures\UninstallPublish.crw.ReadManual.F30D4911	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe

Drops desktop.ini file(s) 24 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\Program Files\RecoveryManual.html	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
File created	\??\c:\Program Files (x86)\RecoveryManual.html	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.F30D4911\shell\Open	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.F30D4911\shell\Open\command\ = "explorer.exe RecoveryManual.html"	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.F30D4911\shell\Open\command	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.F30D4911	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.F30D4911\shell	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
2680	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2680	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Token: SeDebugPrivilege	2680	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 424	2680	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe	71
PID 2680 wrote to memory of 424	2680	00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe	71
PID 424 wrote to memory of 2304	424	cmd.exe	73
PID 424 wrote to memory of 2304	424	cmd.exe	73

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2304	attrib.exe

C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
"C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0F75EE87.bat" "C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"
    3⤵
    - Views/modifies file attributes
    PID:2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads