mountlocker | 31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

General

Target

c09b509699aeef71f3e205d53c5f4ff71cb48570.dll
Size

77KB
MD5

0aacf2c41ba9b872a52055ffcaeaef15
SHA1

c09b509699aeef71f3e205d53c5f4ff71cb48570
SHA256

31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585
SHA512

d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec
SSDEEP

1536:rADwfmySY6FIsr4XSZ32tcOGwpin2NI2F4cd:UDwTF6+srGi32tcOGwpin2NMcd

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61 </pre> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61</a> * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61</a> 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days. </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Family

mountlocker

Ransom Note

Your ClientId: /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61 * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days.

URLs

http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64333d3957fd7b47717abe00375993d6d61

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 28 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConvertToClose.png => \??\c:\Users\Admin\Pictures\ConvertToClose.png.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\GrantWait.crw => \??\c:\Users\Admin\Pictures\GrantWait.crw.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RequestFind.png => \??\c:\Users\Admin\Pictures\RequestFind.png.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RevokeCompress.crw => \??\c:\Users\Admin\Pictures\RevokeCompress.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ConvertToClose.png.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\DebugLock.tif => \??\c:\Users\Admin\Pictures\DebugLock.tif.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\GrantWait.crw.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\InvokeWrite.crw => \??\c:\Users\Admin\Pictures\InvokeWrite.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\RequestFind.png.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\InvokeWrite.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\RemoveEnable.tiff.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ResetTrace.crw.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ResolveEnable.tiff => \??\c:\Users\Admin\Pictures\ResolveEnable.tiff.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\WaitInitialize.png.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ReadConvertFrom.tiff.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ResolveEnable.tiff.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\InstallRegister.tif => \??\c:\Users\Admin\Pictures\InstallRegister.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\SearchConvert.crw => \??\c:\Users\Admin\Pictures\SearchConvert.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\SearchConvert.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\InstallRegister.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ReadConvertFrom.tiff => \??\c:\Users\Admin\Pictures\ReadConvertFrom.tiff.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RemoveEnable.tiff => \??\c:\Users\Admin\Pictures\RemoveEnable.tiff.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\WaitInitialize.png => \??\c:\Users\Admin\Pictures\WaitInitialize.png.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\DebugLock.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\LimitRename.tif => \??\c:\Users\Admin\Pictures\LimitRename.tif.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\LimitRename.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ResetTrace.crw => \??\c:\Users\Admin\Pictures\ResetTrace.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\RevokeCompress.crw.ReadManual.64BD3273	regsvr32.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1544 cmd.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

296 vssadmin.exe

pid	process
1544	cmd.exe

pid	process
296	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDF64561-B39B-11ED-B883-CED2106B5FC8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.64BD3273\shell\Open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.64BD3273	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.64BD3273\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.64BD3273\shell\Open	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\.64BD3273\shell\Open\command\ = "explorer.exe RecoveryManual.html"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1980 regsvr32.exe
1980 regsvr32.exe

pid	process
1980	regsvr32.exe
1980	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1980	regsvr32.exe
Token: SeBackupPrivilege	1800	vssvc.exe
Token: SeRestorePrivilege	1800	vssvc.exe
Token: SeAuditPrivilege	1800	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1612 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1612 iexplore.exe
1612 iexplore.exe
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE
1292 IEXPLORE.EXE

pid	process
1612	iexplore.exe

pid	process
1612	iexplore.exe
1612	iexplore.exe
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.execmd.exeiexplore.exe

description	pid	process	target process
PID 1968 wrote to memory of 1980	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1980	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1980	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1980	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1980	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1980	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 1980	1968	regsvr32.exe	regsvr32.exe
PID 1980 wrote to memory of 296	1980	regsvr32.exe	vssadmin.exe
PID 1980 wrote to memory of 296	1980	regsvr32.exe	vssadmin.exe
PID 1980 wrote to memory of 296	1980	regsvr32.exe	vssadmin.exe
PID 1980 wrote to memory of 296	1980	regsvr32.exe	vssadmin.exe
PID 1980 wrote to memory of 1544	1980	regsvr32.exe	cmd.exe
PID 1980 wrote to memory of 1544	1980	regsvr32.exe	cmd.exe
PID 1980 wrote to memory of 1544	1980	regsvr32.exe	cmd.exe
PID 1980 wrote to memory of 1544	1980	regsvr32.exe	cmd.exe
PID 1544 wrote to memory of 1940	1544	cmd.exe	attrib.exe
PID 1544 wrote to memory of 1940	1544	cmd.exe	attrib.exe
PID 1544 wrote to memory of 1940	1544	cmd.exe	attrib.exe
PID 1544 wrote to memory of 1940	1544	cmd.exe	attrib.exe
PID 1612 wrote to memory of 1292	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 1292	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 1292	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 1292	1612	iexplore.exe	IEXPLORE.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1940 attrib.exe

pid	process
1940	attrib.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll
2⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\vssadmin.exe
C:\Windows\system32\vssadmin.exe delete shadows /all /Quiet
3⤵
- Interacts with shadow copies
PID:296

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C5024.bat" "C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll""
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\attrib.exe
attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll"
4⤵
- Views/modifies file attributes
PID:1940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RecoveryManual.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html
Filesize
2KB

MD5
e422994ea7cde5c21aa00572c2cd19f2

SHA1
278c11d9f9238906cbea95df932f3d0757ac7e66

SHA256
d0ff34e5a7bf02dfc44812970bea5cc598393fde921df69593c9521006a55229

SHA512
eee145c38bd66df1d7d6921ccb59aef24ee8271c0618f523df0c0738eaad54b1cb9c48ebe9384a2075ade9bbf3f235fe27efd019fc19ed14b7efc1c1920f57cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C5024.bat
Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\006C5024.bat
Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\Desktop\RecoveryManual.html
Filesize
2KB

MD5
e422994ea7cde5c21aa00572c2cd19f2

SHA1
278c11d9f9238906cbea95df932f3d0757ac7e66

SHA256
d0ff34e5a7bf02dfc44812970bea5cc598393fde921df69593c9521006a55229

SHA512
eee145c38bd66df1d7d6921ccb59aef24ee8271c0618f523df0c0738eaad54b1cb9c48ebe9384a2075ade9bbf3f235fe27efd019fc19ed14b7efc1c1920f57cb

Download Submit
memory/1292-476-0x0000000002210000-0x0000000002212000-memory.dmp

Filesize
8KB

Download
memory/1612-475-0x00000000026F0000-0x0000000002700000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads