Overview

overview

10

Static

static

3

226a723ffb...f2.exe

windows7-x64

10

226a723ffb...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e22b5ecbdbe9443e99e242c63163ba60cf46b67582a2c07999f2f06a450d77f3

  • Size

    68KB

  • Sample

    240417-rcsm3scd61

  • MD5

    8eed515ccd6606151cf9fd828ec60728

  • SHA1

    4ff1c96a4cbc1d8b6ee790176ed2c11c151cf41a

  • SHA256

    e22b5ecbdbe9443e99e242c63163ba60cf46b67582a2c07999f2f06a450d77f3

  • SHA512

    8bf35c00b4a23a118e1f49d12e11fc5e1f229b16c4e652190792f58aca1b08f0fdd8b453c6fb9b291c1be4090823ba0bce29dbfbdaf9370645a9c42c508fa24a

  • SSDEEP

    1536:FeXApyrxqK0QdmQws8EoohLv8TCk/KDUY9+0AY2cx8m6k:U1xqpWmQF8Roxv8B/KDJ9+0dP8K

Score
10/10
mountlockerransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> aa0a8ea69e22c4a789b451ab4101d8503085a602d1a403c2e00577a9cc00a162 </pre> </b> <hr/> <b>/!\ YOUR NETWORK HAS BEEN HACKED /!\<br> All your important files have been encrypted!</b><br> <hr/> Your files are safe! Only encrypted.<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> You can send us 2-3 files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> Also we gathered highly confidential/personal data from your network. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you won't pay, we will release your data to public or reseller.<br> So you can expect your data to be published or improperly used in the near future.<br> In this case you will face all legal and reputational consequences of the leak.<br> We only desire to get a ransom and we don't aim to damage your reputation or destroy<br> your business.<br><br> <hr/> <b>Contact us to discuss your next step.</b><br><br> <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8503085a602d1a403c2e00577a9cc00a162">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8503085a602d1a403c2e00577a9cc00a162</a><br> * Note that this server is only available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8503085a602d1a403c2e00577a9cc00a162". <br> 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <br><br> <hr/> <b>If you can`t use the above link, use the email:</b><br> <a href="mailto:[email protected]">[email protected]</a><br> Please note, sometimes our support is away from keyboard, but we will reply shortly.<br> Kindly advise you to contact us as soon as possible.<br></b><br> </body> </html>
Emails

href="mailto:[email protected]">[email protected]</a><br>

Extracted

Path

C:\Program Files\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154 </pre> </b> <hr/> <b>/!\ YOUR NETWORK HAS BEEN HACKED /!\<br> All your important files have been encrypted!</b><br> <hr/> Your files are safe! Only encrypted.<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> You can send us 2-3 files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> Also we gathered highly confidential/personal data from your network. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you won't pay, we will release your data to public or reseller.<br> So you can expect your data to be published or improperly used in the near future.<br> In this case you will face all legal and reputational consequences of the leak.<br> We only desire to get a ransom and we don't aim to damage your reputation or destroy<br> your business.<br><br> <hr/> <b>Contact us to discuss your next step.</b><br><br> <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154</a><br> * Note that this server is only available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154". <br> 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <br><br> <hr/> <b>If you can`t use the above link, use the email:</b><br> <a href="mailto:[email protected]">[email protected]</a><br> Please note, sometimes our support is away from keyboard, but we will reply shortly.<br> Kindly advise you to contact us as soon as possible.<br></b><br> </body> </html>
Emails

href="mailto:[email protected]">[email protected]</a><br>

Targets

    • Target

      226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

    • Size

      200KB

    • MD5

      c2671bf5b5dedbfd3cfe3f0f944fbe01

    • SHA1

      da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1

    • SHA256

      226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2

    • SHA512

      256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9

    • SSDEEP

      1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00

    Score
    10/10
    mountlockerransomware

    • MountLocker Ransomware

      Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

      ransomwaremountlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes itself

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks