Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Ransomware...KB.exe
windows10-ltsc_2021-x64
7Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
7Ransomware...KB.exe
windows10-ltsc_2021-x64
7Ransomware...KB.exe
windows11-21h2-x64
7Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows7-x64
9Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.exe
windows7-x64
9Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.ps1
windows11-21h2-x64
10Ransomware...KB.ps1
windows7-x64
10Ransomware...KB.ps1
windows10-2004-x64
10Ransomware...KB.ps1
windows10-ltsc_2021-x64
10Ransomware...KB.ps1
windows11-21h2-x64
10Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10Analysis
-
max time kernel
76s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2025, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win7-20241010-en
Behavioral task
behavioral3
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral5
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral6
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral7
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral11
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win7-20250207-en
Behavioral task
behavioral13
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral14
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral15
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral16
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral21
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win11-20250314-en
Behavioral task
behavioral22
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win7-20241023-en
Behavioral task
behavioral23
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral24
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral25
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral26
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win11-20250313-en
Behavioral task
behavioral27
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral30
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win11-20250313-en
General
-
Target
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
-
Size
200KB
-
MD5
c2671bf5b5dedbfd3cfe3f0f944fbe01
-
SHA1
da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1
-
SHA256
226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2
-
SHA512
256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9
-
SSDEEP
1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\RecoveryManual.html
href="mailto:[email protected]">[email protected]</a><br>
Signatures
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Mountlocker family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4840 powershell.exe -
Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\3D Objects\desktop.ini MountLocker_20_11_2020_200KB.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\f: MountLocker_20_11_2020_200KB.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\PSReadline.psd1 MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\Locales\ru.pak.DATA MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\logs\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\it.pak MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\dotnet\host\fxr\7.0.16\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Java\jdk-1.8\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-left.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\ui-strings.js MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close-2.svg MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Stable.msix.DATA MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_filetype_xd.svg MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\sr.pak MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\info.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\gu.txt MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg MountLocker_20_11_2020_200KB.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MountLocker_20_11_2020_200KB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\.EF9E23B4\shell\Open MountLocker_20_11_2020_200KB.exe Set value (str) \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\.EF9E23B4\shell\Open\command\ = "explorer.exe RecoveryManual.html" MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\.EF9E23B4\shell\Open\command MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\.EF9E23B4 MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\.EF9E23B4\shell MountLocker_20_11_2020_200KB.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4840 powershell.exe 4840 powershell.exe 4840 powershell.exe 4840 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4840 powershell.exe Token: SeTakeOwnershipPrivilege 3068 MountLocker_20_11_2020_200KB.exe Token: SeRestorePrivilege 3068 MountLocker_20_11_2020_200KB.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3068 MountLocker_20_11_2020_200KB.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3068 wrote to memory of 4840 3068 MountLocker_20_11_2020_200KB.exe 89 PID 3068 wrote to memory of 4840 3068 MountLocker_20_11_2020_200KB.exe 89 PID 3068 wrote to memory of 4840 3068 MountLocker_20_11_2020_200KB.exe 89 PID 3068 wrote to memory of 2532 3068 MountLocker_20_11_2020_200KB.exe 106 PID 3068 wrote to memory of 2532 3068 MountLocker_20_11_2020_200KB.exe 106 PID 3068 wrote to memory of 2532 3068 MountLocker_20_11_2020_200KB.exe 106 PID 2532 wrote to memory of 2788 2532 cmd.exe 109 PID 2532 wrote to memory of 2788 2532 cmd.exe 109 PID 2532 wrote to memory of 2788 2532 cmd.exe 109 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2788 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden -c $mypid='3068';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~240602656.tmp')|iex2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E57BD64.bat" "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2788
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50355322e06718ceb217bbdc4c2cca27b
SHA1e5fb3ad86116390d9a898a40a6e64c29ddf3dbfb
SHA256e962fb3b39afabbf6c6bf14be3f475dcb3ea48bbee23c73f33f63f0d4880a156
SHA5124f643ae076545114de86d58f1c74afbef5f2f7b6b1df11bc7948f669a733c6cd8ad4baf4667f03912267e79dfeec8e721cf0f91b92ec874278b68fc3c99c158d
-
Filesize
65B
MD5348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD54e1a1e3e715c291c71950d2fdc79e2be
SHA1dc2b3d20a9ec88e0d8d75c5097154687acc42983
SHA256acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39
SHA512d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80