Overview

overview

10

Static

static

10

0fa0ad3dbf...c7.exe

windows7_x64

10

0fa0ad3dbf...c7.exe

windows10_x64

10

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    29-11-2021 11:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fa0ad3dbf321d2c7c645aab928176d7a2d21b64d84d720829b67ad6c37381c7.exe

  • Size

    56KB

  • MD5

    af2cac864d51827a760560a2d1df8fe8

  • SHA1

    651f6e8aeb91cf84eb809a3d0fdcf67ba80c8339

  • SHA256

    0fa0ad3dbf321d2c7c645aab928176d7a2d21b64d84d720829b67ad6c37381c7

  • SHA512

    dbc929410cf09408086cdff6b5e03e143568296084929c19eefc045e5228676cbd40e6daaf3a39463c69ec87c1ca099f2f50dc92351cb802f3aa1642be205b86

Score
10/10
mountlockerransomware

Malware Config

Extracted

Path

\??\c:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> acc47d8e8c2a4ba5c4c325fca35d0ae4348f6913d8a37fc7eb0e40e1d577985a </pre> </b> <hr/> If you are here, you want to know what happened.<br><br> We infiltrated your network, controlled it for a while, examined your data, downloaded sensitive information and finally encrypted your computers.<br> Your files are safe, but encrypted. Any attempt to decrypt files with third-party software will permanently corrupt content.<br><br> <b>What now?</b><br><br> We advise you to be in touch and start negotiations, otherwise your confidential data will be published on few our news sites and promoted in all possible ways.<br> Data publication and even the fact of this leak for sure will lead to significant losses for your company: <ul> <li>government fines <li>lawsuits and as a result legal claims payments <li>additional expenses on law services <li>data recovery </ul> Also you shouldn't underestimate huge damage for your reputation, which can cause crash of equity prices, clients withdrawal and other negative consequences.<br><br> <b>But don't panic! We are doing business, not war.</b><br><br> We can unlock your data and keep everything in secret. All, what we want is a ransom.<br><br> If we can reach an agreement, you also get: <ul> <li>security report <li>full file tree of compromised data <li>downloaded data unrecoverable deletion <li>support with unlocking and network protection advice. </ul> <b>How can you contact us?</b><br> Visit our support chat. It is simple, secure and you can set a password to avoid intervention of unauthorised persons.<br> <a href="http://evl425tkt4hkwryyplvqu6bn6slfow3fa4xwgvwe5t4zf6gizs3ewuyd.onion/?cid=acc47d8e8c2a4ba5c4c325fca35d0ae4348f6913d8a37fc7eb0e40e1d577985a">http://evl425tkt4hkwryyplvqu6bn6slfow3fa4xwgvwe5t4zf6gizs3ewuyd.onion/?cid=acc47d8e8c2a4ba5c4c325fca35d0ae4348f6913d8a37fc7eb0e40e1d577985a</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> Follow the instructions to open the link: <ol> <li>Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor Project website. <li>Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. <li>Now you have Tor browser. In the Tor Browser open "http://evl425tkt4hkwryyplvqu6bn6slfow3fa4xwgvwe5t4zf6gizs3ewuyd.onion/?cid=acc47d8e8c2a4ba5c4c325fca35d0ae4348f6913d8a37fc7eb0e40e1d577985a". <li>Start a chat and introduce yourself (Company name and your position). </ol> Password field should be blank for the first login. You can ask an operator to set password later. </body> </html>

Signatures

  • MountLocker Ransomware

    Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

    ransomwaremountlocker
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops desktop.ini file(s) 32 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fa0ad3dbf321d2c7c645aab928176d7a2d21b64d84d720829b67ad6c37381c7.exe
    "C:\Users\Admin\AppData\Local\Temp\0fa0ad3dbf321d2c7c645aab928176d7a2d21b64d84d720829b67ad6c37381c7.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F766190.bat" "C:\Users\Admin\AppData\Local\Temp\0fa0ad3dbf321d2c7c645aab928176d7a2d21b64d84d720829b67ad6c37381c7.exe""
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:736
      • C:\Windows\SysWOW64\attrib.exe
        attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\0fa0ad3dbf321d2c7c645aab928176d7a2d21b64d84d720829b67ad6c37381c7.exe"
        3⤵
        • Views/modifies file attributes
        PID:1100

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0F766190.bat
    MD5

    348cae913e496198548854f5ff2f6d1e

    SHA1

    a07655b9020205bd47084afd62a8bb22b48c0cdc

    SHA256

    c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

    SHA512

    799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

    Download Submit
  • memory/736-56-0x0000000000000000-mapping.dmp
    Download
  • memory/1100-58-0x0000000000000000-mapping.dmp
    Download
  • memory/1588-55-0x00000000764D1000-0x00000000764D3000-memory.dmp
    Filesize

    8KB

    Download