Overview

overview

10

Static

static

10

30050b3673...83.msi

windows7-x64

10

30050b3673...83.msi

windows10-2004-x64

10

Resubmissions

14-09-2022 11:45

220914-nwrncadhel 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi

  • Size

    112KB

  • Sample

    220914-nwrncadhel

  • MD5

    ce3969ab935f0f5b1301cd70d2e59696

  • SHA1

    e70d3341a6e2cc8ae0f140075837ceac4453b947

  • SHA256

    30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83

  • SHA512

    20998be53a994d7adab2b71bafccec1eeb93e356965582161fa1fccea023fbf62b0145adf5e0621118f00a4ea12a71fbb5de2fdd129d92879502a5a3da019a36

  • SSDEEP

    1536:y7WSmywADwaY6FIsr4XSZ32tcOGwpin2NI2F4cdJ0DLx0DL:y7WgpDwd6+srGi32tcOGwpin2NMcd

Score
10/10
mountlockerransomware

Malware Config

Extracted

Path

\??\c:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> d11ebd6225c2dd096733ff8dad28b6433ed09466c0bc630babe00375993d6d4e </pre> </b> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ <br> All your important documents have been encrypted and transferred to our premises!</b><br> <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br> However there is a solution for your problem!<br> We can support you with your data decryption for a monetary reward.<br> Also we will destroy your private data from our premises.<br> And we can prove our decryption capabilities by decrypting couple of your files free of charge.<br> <br> Here are the next steps to get your valuable data back and get it wiped out from our premises:<br> <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6433ed09466c0bc630babe00375993d6d4e">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6433ed09466c0bc630babe00375993d6d4e</a><br> * Note that you need installed Tor Browser to open this kind of links.<br><br> Follow the instructions to install/run Tor Browser:<br> 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge)<br> 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases)<br> 3. Download and Install Tor Browser<br> 4. After installation finished, click on "Tor Browser" link from your Desktop<br> 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6433ed09466c0bc630babe00375993d6d4e">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6433ed09466c0bc630babe00375993d6d4e</a><br> 6. Copy your client id from the top of this document and paste it into Authorization window if requested <br> 7. This will start a chat with our security experts.<br> Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible.<br> Also, we kindly request you to contact with us as soon as possible.<br> We will start publishing your private data to the Internet if you don't get in touch with us within next few days.<br> </body> </html>

Extracted

Path

\??\c:\odt\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58 </pre> </b> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ <br> All your important documents have been encrypted and transferred to our premises!</b><br> <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br> However there is a solution for your problem!<br> We can support you with your data decryption for a monetary reward.<br> Also we will destroy your private data from our premises.<br> And we can prove our decryption capabilities by decrypting couple of your files free of charge.<br> <br> Here are the next steps to get your valuable data back and get it wiped out from our premises:<br> <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58</a><br> * Note that you need installed Tor Browser to open this kind of links.<br><br> Follow the instructions to install/run Tor Browser:<br> 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge)<br> 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases)<br> 3. Download and Install Tor Browser<br> 4. After installation finished, click on "Tor Browser" link from your Desktop<br> 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58</a><br> 6. Copy your client id from the top of this document and paste it into Authorization window if requested <br> 7. This will start a chat with our security experts.<br> Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible.<br> Also, we kindly request you to contact with us as soon as possible.<br> We will start publishing your private data to the Internet if you don't get in touch with us within next few days.<br> </body> </html>

Targets

    • Target

      30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi

    • Size

      112KB

    • MD5

      ce3969ab935f0f5b1301cd70d2e59696

    • SHA1

      e70d3341a6e2cc8ae0f140075837ceac4453b947

    • SHA256

      30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83

    • SHA512

      20998be53a994d7adab2b71bafccec1eeb93e356965582161fa1fccea023fbf62b0145adf5e0621118f00a4ea12a71fbb5de2fdd129d92879502a5a3da019a36

    • SSDEEP

      1536:y7WSmywADwaY6FIsr4XSZ32tcOGwpin2NI2F4cdJ0DLx0DL:y7WgpDwd6+srGi32tcOGwpin2NMcd

    Score
    10/10
    mountlockerransomware

    • Detected Mount Locker ransomware

    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

      ransomwaremountlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks