mountlocker | e22b5ecbdbe9443e99e242c63163ba60cf46b67582a2c07999f2f06a450d77f3

General

Target

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
Size

200KB
MD5

c2671bf5b5dedbfd3cfe3f0f944fbe01
SHA1

da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1
SHA256

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2
SHA512

256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9
SSDEEP

1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

C:\Program Files\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154 </pre> <hr/> /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! <hr/> Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. <hr/> Contact us to discuss your next step. <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154</a> * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502596b906dfba03cbe00577a9cc00a154". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <hr/> If you can`t use the above link, use the email: <a href="mailto:SloanAlbert@protonmail.com">SloanAlbert@protonmail.com</a> Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible. </body> </html>

Emails

href="mailto:SloanAlbert@protonmail.com">SloanAlbert@protonmail.com</a>

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker

Drops desktop.ini file(s) 28 IoCs

Processes:

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

description	ioc	process
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

description ioc process

File opened (read-only) \??\f: 226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

description	ioc	process
File opened (read-only)	\??\f:	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

Drops file in Program Files directory 64 IoCs

Processes:

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare.HxS	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sv.txt	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\next-arrow-default.svg	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning@4x.png	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\ui-strings.js	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\eo.txt	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files\VideoLAN\VLC\lua\meta\art\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview.svg	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main.css	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\over-arrow-navigation.svg	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\http\view.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\ui-strings.js	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check_2x.png	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\MSFT_PackageManagementSource.strings.psd1	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\RecoveryManual.html	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\ui-strings.js	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zx______.pfm	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

Modifies registry class 5 IoCs

Processes:

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.EF9E23B4	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.EF9E23B4\shell	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.EF9E23B4\shell\Open	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.EF9E23B4\shell\Open\command\ = "explorer.exe RecoveryManual.html"	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\.EF9E23B4\shell\Open\command	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exe

pid process

1344 powershell.exe
1344 powershell.exe
1344 powershell.exe
1344 powershell.exe
1344 powershell.exe

pid	process
1344	powershell.exe
1344	powershell.exe
1344	powershell.exe
1344	powershell.exe
1344	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exe226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

description	pid	process
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
Token: SeRestorePrivilege	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

pid process

3068 226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

pid	process
3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.execmd.exe

description	pid	process	target process
PID 3068 wrote to memory of 1344	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe	powershell.exe
PID 3068 wrote to memory of 1344	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe	powershell.exe
PID 3068 wrote to memory of 1344	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe	powershell.exe
PID 3068 wrote to memory of 2380	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe	cmd.exe
PID 3068 wrote to memory of 2380	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe	cmd.exe
PID 3068 wrote to memory of 2380	3068	226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe	cmd.exe
PID 2380 wrote to memory of 4884	2380	cmd.exe	attrib.exe
PID 2380 wrote to memory of 4884	2380	cmd.exe	attrib.exe
PID 2380 wrote to memory of 4884	2380	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

4884 attrib.exe

pid	process
4884	attrib.exe

C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe
"C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle hidden -c $mypid='3068';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~240613500.tmp')|iex
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E57DC46.bat" "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe""
2⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\attrib.exe
attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2.exe"
3⤵
- Views/modifies file attributes
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RecoveryManual.html
Filesize
2KB

MD5
4e61e622e8f17a1be931d770604e230a

SHA1
d9ea68e78c45f6ac74df2cbbb869ab66616e0e70

SHA256
a4efa650ebc939fcf98cc3b0680cfe30320f478e08e943b5b9939cf5db2fa1d7

SHA512
2eb72845bac600cee0d837094022222eb5a8f47be6224bd359573029d94d10b981fab90107e983cf25644f3685e56e22b0763dc57d4d7502d3e25d6cef0270e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E57DC46.bat
Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_grxkgrvn.mci.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\~240613500.tmp
Filesize
4KB

MD5
4e1a1e3e715c291c71950d2fdc79e2be

SHA1
dc2b3d20a9ec88e0d8d75c5097154687acc42983

SHA256
acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39

SHA512
d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80

Download Submit
memory/1344-63-0x0000000007560000-0x00000000075F6000-memory.dmp

Filesize
600KB

Download
memory/1344-65-0x00000000074E0000-0x00000000074EE000-memory.dmp

Filesize
56KB

Download
memory/1344-45-0x0000000006470000-0x000000000648A000-memory.dmp

Filesize
104KB

Download
memory/1344-73-0x0000000074DB0000-0x0000000075560000-memory.dmp

Filesize
7.7MB

Download
memory/1344-70-0x0000000008480000-0x0000000008A24000-memory.dmp

Filesize
5.6MB

Download
memory/1344-69-0x0000000007600000-0x0000000007622000-memory.dmp

Filesize
136KB

Download
memory/1344-44-0x0000000007850000-0x0000000007ECA000-memory.dmp

Filesize
6.5MB

Download
memory/1344-68-0x0000000007530000-0x0000000007538000-memory.dmp

Filesize
32KB

Download
memory/1344-67-0x0000000007540000-0x000000000755A000-memory.dmp

Filesize
104KB

Download
memory/1344-66-0x00000000074F0000-0x0000000007504000-memory.dmp

Filesize
80KB

Download
memory/1344-64-0x00000000074C0000-0x00000000074D1000-memory.dmp

Filesize
68KB

Download
memory/1344-62-0x0000000007340000-0x000000000734A000-memory.dmp

Filesize
40KB

Download
memory/1344-24-0x0000000074DB0000-0x0000000075560000-memory.dmp

Filesize
7.7MB

Download
memory/1344-23-0x0000000004980000-0x00000000049B6000-memory.dmp

Filesize
216KB

Download
memory/1344-25-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/1344-26-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/1344-27-0x0000000005040000-0x0000000005668000-memory.dmp

Filesize
6.2MB

Download
memory/1344-28-0x0000000004F50000-0x0000000004F72000-memory.dmp

Filesize
136KB

Download
memory/1344-61-0x0000000007240000-0x00000000072E3000-memory.dmp

Filesize
652KB

Download
memory/1344-30-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/1344-60-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/1344-40-0x00000000059E0000-0x0000000005D34000-memory.dmp

Filesize
3.3MB

Download
memory/1344-41-0x0000000005F00000-0x0000000005F1E000-memory.dmp

Filesize
120KB

Download
memory/1344-42-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Filesize
304KB

Download
memory/1344-29-0x0000000005670000-0x00000000056D6000-memory.dmp

Filesize
408KB

Download
memory/1344-58-0x0000000007210000-0x000000000722E000-memory.dmp

Filesize
120KB

Download
memory/1344-59-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/1344-46-0x000000007FB60000-0x000000007FB70000-memory.dmp

Filesize
64KB

Download
memory/1344-47-0x00000000071D0000-0x0000000007202000-memory.dmp

Filesize
200KB

Download
memory/1344-48-0x0000000070C30000-0x0000000070C7C000-memory.dmp

Filesize
304KB

Download
memory/3068-11-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3068-21-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-8559-0x0000000002CB0000-0x0000000002CBF000-memory.dmp

Filesize
60KB

Download
memory/3068-10-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-7-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-2-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-16-0x0000000002CB0000-0x0000000002CBF000-memory.dmp

Filesize
60KB

Download
memory/3068-13-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-15-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-4-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-6-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-14-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-5-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-9-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-74-0x0000000002CB0000-0x0000000002CBF000-memory.dmp

Filesize
60KB

Download
memory/3068-76-0x0000000002CB0000-0x0000000002CBF000-memory.dmp

Filesize
60KB

Download
memory/3068-77-0x0000000002CB0000-0x0000000002CBF000-memory.dmp

Filesize
60KB

Download
memory/3068-3-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-4598-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3068-8-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download
memory/3068-12-0x0000000002CA0000-0x0000000002CA2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads