Resubmissions
17/05/2024, 14:06
240517-reh7esbc831017/05/2024, 14:05
240517-rdxnesbb2x1017/05/2024, 14:04
240517-rdkc4aba911017/05/2024, 14:00
240517-raznlsbc331009/01/2022, 14:18
220109-rl99gsdee210Analysis
- max time kernel
5s - max time network
2s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
17/05/2024, 14:04
Behavioral task
behavioral1
Sample
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
- Size 66KB
- Sample240517-rdkc4aba91
- SHA256 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99
- MD5 2c26b319e378755596f0ac6d293798c8
- SHA1 280a4cfcf5dd87898c3731b680efe061bdb7a9fe
- SHA512 0c2b53a3fed1dbbae64e7f1e7c17a89b5dc607ba40caecd5496e18ffd84cdad844e926742d9fc82a715d6e8b01a1c483d97d54f5be1f2d6997107946f2a3fe4b
- SSDEEP 768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADO2A:DaXq4xTlIdYrhRcH2A
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
- Deletes itself 1 IoCs
pid Process 2760 cmd.exe - Drops desktop.ini file(s) 32 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Searches\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EQ2PZD61\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BB4W7M7Z\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2RM92H5V\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\f: 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created \??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RecoveryManual.html 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File created \??\c:\Program Files\RecoveryManual.html 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File created \??\c:\Program Files (x86)\RecoveryManual.html 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell\Open 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell\Open\command\ = "explorer.exe RecoveryManual.html" 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell\Open\command 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Token: SeDebugPrivilege 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2760 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe 29 PID 2196 wrote to memory of 2760 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe 29 PID 2196 wrote to memory of 2760 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe 29 PID 2760 wrote to memory of 864 2760 cmd.exe 31 PID 2760 wrote to memory of 864 2760 cmd.exe 31 PID 2760 wrote to memory of 864 2760 cmd.exe 31 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 864 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F763276.bat" "C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"3⤵
- Views/modifies file attributes
PID:864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html
- Size 2KB
- SHA256 530af8a0154f6c632ccf0982ee8f22060bd8e3b3c66f38b9a7155a89b7a0e333
- MD5 c05a2821a9fc97a54568466d95a4ad92
- SHA1 f74925d9af5d063e61903d9856527c00911571d1
- SHA512 9a35b2cc667444f63491bfc5e69b1178e0137c64247358295c3abf136c0489aaa3480ba8a9afec4f3618ffec6ca20b63c0bd8782905bffe866251640038b1964
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\0F763276.bat
- Size 65B
- SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
- MD5 348cae913e496198548854f5ff2f6d1e
- SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
- SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
- MD5 SHA1 SHA512