mountlocker | d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97

General

Target

d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97.dll
Size

981KB
MD5

6a72fe78139b79885be94f4bad7edbb8
SHA1

77948ecf0a7114b44d57d51bcea8ecc63263f632
SHA256

d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97
SHA512

43e33153ccfcc76815ddecc43c19714d957aac1dedbd192748f25d86bf096a556a3f4a589e0b7f8f3fa3ee34ab6d75cac49539839ec195396f5d0de84b2b357d
SSDEEP

6144:getwmCnyadCadladGadkad6gadlJad0adZjHad/:rtqyacaHaMa+aEgaXJaqaLjHaR

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> 92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e </pre> <hr/> /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! <hr/> Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. <hr/> Contact us to discuss your next step. <a href="http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e">http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e</a> * Password field could be blank * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://54rz3un5etl3wxc4ckffvnlwleg5s3d4fexv4pir6qacedubmgi7knqd.onion/?cid=92de476f40844b5ed6b3f2599f604fc17b229c7921c59d634fbff72b1f81f64e". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <hr/> Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible. </body> </html>

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker

Deletes itself 1 IoCs

pid	Process
1872	cmd.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Music\Sample Music\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links for United States\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	regsvr32.exe
File opened for modification	\??\c:\Users\Public\Videos\Sample Videos\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\f:	regsvr32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\Program Files\RecoveryManual.html	regsvr32.exe
File created	\??\c:\Program Files (x86)\RecoveryManual.html	regsvr32.exe
File created	\??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RecoveryManual.html	regsvr32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.61D0A30C	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.61D0A30C\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.61D0A30C\shell\Open	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.61D0A30C\shell\Open\command\ = "explorer.exe RecoveryManual.html"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.61D0A30C\shell\Open\command	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2364	regsvr32.exe
2364	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	2364	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1872	2364	regsvr32.exe	28
PID 2364 wrote to memory of 1872	2364	regsvr32.exe	28
PID 2364 wrote to memory of 1872	2364	regsvr32.exe	28
PID 1872 wrote to memory of 868	1872	cmd.exe	30
PID 1872 wrote to memory of 868	1872	cmd.exe	30
PID 1872 wrote to memory of 868	1872	cmd.exe	30

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
868	attrib.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97.dll
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F761A54.bat" "C:\Users\Admin\AppData\Local\Temp\d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97.dll""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\d01048c32a640bba23ed9dfdadd255f225fa5c68ad690e00221500949333ae97.dll"
    3⤵
    - Views/modifies file attributes
    PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html

Filesize
2KB

MD5
b1ee5b5a9cbf211a9effd44a5b86b444

SHA1
5d609884495555fb96ace2ae6a4693a9e44e1f17

SHA256
e9b948f606293576e0295e53f18adddbba03ae30034222c52635bc5bb53b98a2

SHA512
e080c472c8e4b68fdc4a62c0969bb805c5f933924edab5033447953303bc7d61e1160c1e1f3443a7f62c9bbf1c1ab0b25627ab2e393bce85d6c07ef185ab7d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\0F761A54.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit

Analysis

Sharing