mountlocker | 0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44

General

Target

0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe
Size

3.1MB
MD5

368b0fb9d3ecf41b8d013c4d1fa7c0e5
SHA1

a38c5270ef62704a0b9653f301b75216bcdf527d
SHA256

0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44
SHA512

cabb1fd33f67ec77272cad53651f98f6dc6e335e87f10e88d8a0dc4e85b2e2f8e8c8097c02909b6ea22aa9df5a18b3835d93b3c32ebcf468a3533becbe76087a

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

\??\c:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> 7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540 </pre> <hr/> /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! <hr/> Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. <hr/> Contact us to discuss your next step. <a href="http://u5aift7e2s7h5d6hnl6wqkecfor7g6ltwwljbqciek52anm35n3rqiid.onion/?cid=7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540">http://u5aift7e2s7h5d6hnl6wqkecfor7g6ltwwljbqciek52anm35n3rqiid.onion/?cid=7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540</a> * Password field could be blank * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://u5aift7e2s7h5d6hnl6wqkecfor7g6ltwwljbqciek52anm35n3rqiid.onion/?cid=7d4476319502df7952972775d8cf930672df985a7c38e89a2d625284284e8540". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <hr/> Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible. </body> </html>

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker

Executes dropped EXE 1 IoCs

pid	Process
760	PerfomanceKit.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\UnlockNew.tiff	PerfomanceKit.exe
File renamed	C:\Users\Admin\Pictures\UnlockNew.tiff => \??\c:\Users\Admin\Pictures\UnlockNew.tiff.ReadManual.5AB7ED3B	PerfomanceKit.exe
File renamed	C:\Users\Admin\Pictures\RequestPop.tif => \??\c:\Users\Admin\Pictures\RequestPop.tif.ReadManual.5AB7ED3B	PerfomanceKit.exe

Loads dropped DLL 2 IoCs

pid	Process
1380	0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe
760	PerfomanceKit.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	PerfomanceKit.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	PerfomanceKit.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\Program Files\RecoveryManual.html	PerfomanceKit.exe
File created	\??\c:\Program Files (x86)\RecoveryManual.html	PerfomanceKit.exe
File created	\??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RecoveryManual.html	PerfomanceKit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\.5AB7ED3B\shell\Open\command	PerfomanceKit.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\.5AB7ED3B	PerfomanceKit.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\.5AB7ED3B\shell	PerfomanceKit.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\.5AB7ED3B\shell\Open	PerfomanceKit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\.5AB7ED3B\shell\Open\command\ = "explorer.exe RecoveryManual.html"	PerfomanceKit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
760	PerfomanceKit.exe
760	PerfomanceKit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	760	PerfomanceKit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 760	1380	0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe	28
PID 1380 wrote to memory of 760	1380	0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe	28
PID 1380 wrote to memory of 760	1380	0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe	28
PID 1380 wrote to memory of 760	1380	0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe	28
PID 760 wrote to memory of 952	760	PerfomanceKit.exe	30
PID 760 wrote to memory of 952	760	PerfomanceKit.exe	30
PID 760 wrote to memory of 952	760	PerfomanceKit.exe	30
PID 760 wrote to memory of 952	760	PerfomanceKit.exe	30
PID 952 wrote to memory of 2040	952	cmd.exe	32
PID 952 wrote to memory of 2040	952	cmd.exe	32
PID 952 wrote to memory of 2040	952	cmd.exe	32
PID 952 wrote to memory of 2040	952	cmd.exe	32

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe
"C:\Users\Admin\AppData\Local\Temp\0fc52ab540452b524dadb3a7dbcd2a7f1c2d5c553229d77cfbff0d800f8c0f44.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Programs\MariaDBPerfomanceKit\PerfomanceKit.exe
  C:\Users\Admin\AppData\Local\Programs\MariaDBPerfomanceKit\PerfomanceKit.exe
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F76BE11.bat" "C:\Users\Admin\AppData\Local\Programs\MariaDBPerfomanceKit\PerfomanceKit.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -r -h "C:\Users\Admin\AppData\Local\Programs\MariaDBPerfomanceKit\PerfomanceKit.exe"
      4⤵
      Views/modifies file attributes
      PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads