Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Ransomware...KB.exe
windows10-ltsc_2021-x64
7Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
7Ransomware...KB.exe
windows10-ltsc_2021-x64
7Ransomware...KB.exe
windows11-21h2-x64
7Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows7-x64
9Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.exe
windows7-x64
9Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.ps1
windows11-21h2-x64
10Ransomware...KB.ps1
windows7-x64
10Ransomware...KB.ps1
windows10-2004-x64
10Ransomware...KB.ps1
windows10-ltsc_2021-x64
10Ransomware...KB.ps1
windows11-21h2-x64
10Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win7-20241010-en
Behavioral task
behavioral3
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral5
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral6
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral7
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral11
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win7-20250207-en
Behavioral task
behavioral13
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral14
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral15
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral16
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral21
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win11-20250314-en
Behavioral task
behavioral22
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win7-20241023-en
Behavioral task
behavioral23
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral24
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral25
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral26
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win11-20250313-en
Behavioral task
behavioral27
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral30
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win11-20250313-en
General
-
Target
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
-
Size
200KB
-
MD5
c2671bf5b5dedbfd3cfe3f0f944fbe01
-
SHA1
da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1
-
SHA256
226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2
-
SHA512
256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9
-
SSDEEP
1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.html
href="mailto:[email protected]">[email protected]</a><br>
Signatures
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Mountlocker family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1684 powershell.exe -
Deletes itself 1 IoCs
pid Process 1816 cmd.exe -
Drops desktop.ini file(s) 36 IoCs
description ioc Process File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Games\FreeCell\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Games\Mahjong\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Games\Chess\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Games\Hearts\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Games\Solitaire\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini MountLocker_20_11_2020_200KB.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\f: MountLocker_20_11_2020_200KB.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jre7\lib\zi\Europe\Zurich MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN010.XML MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Angles.thmx MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostTitle.XSL MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02028K.JPG MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Windows NT\TableTextService\en-US\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\SaveBackup.dotx MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jre7\lib\zi\America\Antigua MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00458_.WMF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.GIF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02404_.WMF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Apothecary.thmx MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149407.WMF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47F.GIF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\highDpiImageSwap.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\zh-cn.txt MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\plugins.dat MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746G.GIF MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESPS.ICO MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RecoveryManual.html MountLocker_20_11_2020_200KB.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MountLocker_20_11_2020_200KB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2936 vssadmin.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\.EF9E23B4\shell\Open MountLocker_20_11_2020_200KB.exe Set value (str) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\.EF9E23B4\shell\Open\command\ = "explorer.exe RecoveryManual.html" MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\.EF9E23B4\shell\Open\command MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\.EF9E23B4 MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\.EF9E23B4\shell MountLocker_20_11_2020_200KB.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1684 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1684 powershell.exe Token: SeBackupPrivilege 2844 vssvc.exe Token: SeRestorePrivilege 2844 vssvc.exe Token: SeAuditPrivilege 2844 vssvc.exe Token: SeTakeOwnershipPrivilege 2508 MountLocker_20_11_2020_200KB.exe Token: SeRestorePrivilege 2508 MountLocker_20_11_2020_200KB.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2508 MountLocker_20_11_2020_200KB.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1684 2508 MountLocker_20_11_2020_200KB.exe 30 PID 2508 wrote to memory of 1684 2508 MountLocker_20_11_2020_200KB.exe 30 PID 2508 wrote to memory of 1684 2508 MountLocker_20_11_2020_200KB.exe 30 PID 2508 wrote to memory of 1684 2508 MountLocker_20_11_2020_200KB.exe 30 PID 1684 wrote to memory of 2936 1684 powershell.exe 32 PID 1684 wrote to memory of 2936 1684 powershell.exe 32 PID 1684 wrote to memory of 2936 1684 powershell.exe 32 PID 1684 wrote to memory of 2936 1684 powershell.exe 32 PID 2508 wrote to memory of 1816 2508 MountLocker_20_11_2020_200KB.exe 37 PID 2508 wrote to memory of 1816 2508 MountLocker_20_11_2020_200KB.exe 37 PID 2508 wrote to memory of 1816 2508 MountLocker_20_11_2020_200KB.exe 37 PID 2508 wrote to memory of 1816 2508 MountLocker_20_11_2020_200KB.exe 37 PID 1816 wrote to memory of 796 1816 cmd.exe 39 PID 1816 wrote to memory of 796 1816 cmd.exe 39 PID 1816 wrote to memory of 796 1816 cmd.exe 39 PID 1816 wrote to memory of 796 1816 cmd.exe 39 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 796 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden -c $mypid='2508';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~259431877.tmp')|iex2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /Quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2936
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F7749EC.bat" "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:796
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD532e86556c64e1ae275fae7e5a43cf621
SHA18260b48adcd9510192a1a300d7212a369e037f1e
SHA256b706bb6fd63f21486f3ad6bfa286dc7d2afa9bb7d6cda4c0ff178d72f58b5263
SHA51243b6670978ac4019afe9398248433f37db4f0ed6246b49dc6b41ffff10dca309024b65fba07f6f5f946b91a3275a45e12fc42201555aecd40f92f3e59c5f3d3e
-
Filesize
65B
MD5348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
-
Filesize
4KB
MD54e1a1e3e715c291c71950d2fdc79e2be
SHA1dc2b3d20a9ec88e0d8d75c5097154687acc42983
SHA256acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39
SHA512d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80