mountlocker | c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

Analysis

max time kernel
940s
max time network
1217s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2022 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Size

200KB
MD5

c2671bf5b5dedbfd3cfe3f0f944fbe01
SHA1

da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1
SHA256

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2
SHA512

256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9
SSDEEP

1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

\??\c:\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> aa0a8ea69e22c4a789b451ab4101d850289bbf06cca919cbe00577a9cc00a158 </pre> <hr/> /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! <hr/> Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. <hr/> Contact us to discuss your next step. <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850289bbf06cca919cbe00577a9cc00a158">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850289bbf06cca919cbe00577a9cc00a158</a> * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850289bbf06cca919cbe00577a9cc00a158". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <hr/> If you can`t use the above link, use the email: <a href="mailto:SloanAlbert@protonmail.com">SloanAlbert@protonmail.com</a> Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible. </body> </html>

Emails

href="mailto:SloanAlbert@protonmail.com">SloanAlbert@protonmail.com</a>

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

MountLocker_20_11_2020_200KB.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExitUnprotect.png => \??\c:\Users\Admin\Pictures\ExitUnprotect.png.ReadManual.EF9E23B4	MountLocker_20_11_2020_200KB.exe
File renamed	C:\Users\Admin\Pictures\OptimizeAssert.tif => \??\c:\Users\Admin\Pictures\OptimizeAssert.tif.ReadManual.EF9E23B4	MountLocker_20_11_2020_200KB.exe
File renamed	C:\Users\Admin\Pictures\ResetWrite.crw => \??\c:\Users\Admin\Pictures\ResetWrite.crw.ReadManual.EF9E23B4	MountLocker_20_11_2020_200KB.exe
File renamed	C:\Users\Admin\Pictures\RestartUndo.raw => \??\c:\Users\Admin\Pictures\RestartUndo.raw.ReadManual.EF9E23B4	MountLocker_20_11_2020_200KB.exe

Drops desktop.ini file(s) 28 IoCs

Processes:

MountLocker_20_11_2020_200KB.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	MountLocker_20_11_2020_200KB.exe

Drops file in Program Files directory 64 IoCs

Processes:

MountLocker_20_11_2020_200KB.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\kk.pak.DATA	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Staging	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\over-arrow-navigation.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Edge.dat	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail2x.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\main.css	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\en_CA.dic	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jre1.8.0_66\release	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RTC.der	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_removeme-default_18.svg	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\css\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Extensions\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\manifest.json.DATA	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\It.snippets.ps1xml	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\http\view.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\delete.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\favicon.ico	MountLocker_20_11_2020_200KB.exe

Modifies registry class 5 IoCs

Processes:

MountLocker_20_11_2020_200KB.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.EF9E23B4\shell\Open\command	MountLocker_20_11_2020_200KB.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.EF9E23B4	MountLocker_20_11_2020_200KB.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.EF9E23B4\shell	MountLocker_20_11_2020_200KB.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.EF9E23B4\shell\Open	MountLocker_20_11_2020_200KB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.EF9E23B4\shell\Open\command\ = "explorer.exe RecoveryManual.html"	MountLocker_20_11_2020_200KB.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exe

pid process

1432 powershell.exe
1432 powershell.exe
1432 powershell.exe
1432 powershell.exe
1432 powershell.exe

pid	process
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeMountLocker_20_11_2020_200KB.exe

description	pid	process
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeTakeOwnershipPrivilege	3332	MountLocker_20_11_2020_200KB.exe
Token: SeRestorePrivilege	3332	MountLocker_20_11_2020_200KB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MountLocker_20_11_2020_200KB.exe

pid process

3332 MountLocker_20_11_2020_200KB.exe

pid	process
3332	MountLocker_20_11_2020_200KB.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

MountLocker_20_11_2020_200KB.execmd.exe

description	pid	process	target process
PID 3332 wrote to memory of 1432	3332	MountLocker_20_11_2020_200KB.exe	powershell.exe
PID 3332 wrote to memory of 1432	3332	MountLocker_20_11_2020_200KB.exe	powershell.exe
PID 3332 wrote to memory of 1432	3332	MountLocker_20_11_2020_200KB.exe	powershell.exe
PID 3332 wrote to memory of 1492	3332	MountLocker_20_11_2020_200KB.exe	cmd.exe
PID 3332 wrote to memory of 1492	3332	MountLocker_20_11_2020_200KB.exe	cmd.exe
PID 3332 wrote to memory of 1492	3332	MountLocker_20_11_2020_200KB.exe	cmd.exe
PID 1492 wrote to memory of 4656	1492	cmd.exe	attrib.exe
PID 1492 wrote to memory of 4656	1492	cmd.exe	attrib.exe
PID 1492 wrote to memory of 4656	1492	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4656 attrib.exe

pid	process
4656	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe
"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden -c $mypid='3332';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~240575937.tmp')|iex
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E58406F.bat" "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe""
2⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\attrib.exe
attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"
3⤵
- Views/modifies file attributes
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0E58406F.bat
Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\~240575937.tmp
Filesize
4KB

MD5
4e1a1e3e715c291c71950d2fdc79e2be

SHA1
dc2b3d20a9ec88e0d8d75c5097154687acc42983

SHA256
acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39

SHA512
d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80

Download Submit
memory/1432-150-0x0000000070890000-0x00000000708DC000-memory.dmp

Filesize
304KB

Download
memory/1432-142-0x00000000050C0000-0x00000000050E2000-memory.dmp

Filesize
136KB

Download
memory/1432-151-0x0000000007160000-0x000000000717E000-memory.dmp

Filesize
120KB

Download
memory/1432-143-0x0000000005160000-0x00000000051C6000-memory.dmp

Filesize
408KB

Download
memory/1432-144-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/1432-145-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Filesize
120KB

Download
memory/1432-140-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

Filesize
216KB

Download
memory/1432-147-0x0000000007810000-0x0000000007E8A000-memory.dmp

Filesize
6.5MB

Download
memory/1432-152-0x00000000074E0000-0x00000000074EA000-memory.dmp

Filesize
40KB

Download
memory/1432-149-0x0000000007390000-0x00000000073C2000-memory.dmp

Filesize
200KB

Download
memory/1432-139-0x0000000000000000-mapping.dmp

Download
memory/1432-141-0x00000000051F0000-0x0000000005818000-memory.dmp

Filesize
6.2MB

Download
memory/1432-148-0x0000000006620000-0x000000000663A000-memory.dmp

Filesize
104KB

Download
memory/1432-153-0x0000000007700000-0x0000000007796000-memory.dmp

Filesize
600KB

Download
memory/1432-154-0x0000000007680000-0x000000000768E000-memory.dmp

Filesize
56KB

Download
memory/1432-155-0x00000000076E0000-0x00000000076FA000-memory.dmp

Filesize
104KB

Download
memory/1432-156-0x00000000076D0000-0x00000000076D8000-memory.dmp

Filesize
32KB

Download
memory/1432-157-0x00000000077A0000-0x00000000077C2000-memory.dmp

Filesize
136KB

Download
memory/1432-158-0x0000000008440000-0x00000000089E4000-memory.dmp

Filesize
5.6MB

Download
memory/1492-159-0x0000000000000000-mapping.dmp

Download
memory/3332-134-0x0000000004810000-0x000000000481F000-memory.dmp

Filesize
60KB

Download
memory/4656-161-0x0000000000000000-mapping.dmp

Download