Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Ransomware...KB.exe
windows10-ltsc_2021-x64
7Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
7Ransomware...KB.exe
windows10-ltsc_2021-x64
7Ransomware...KB.exe
windows11-21h2-x64
7Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows7-x64
9Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.exe
windows7-x64
9Ransomware...KB.exe
windows10-2004-x64
9Ransomware...KB.exe
windows10-ltsc_2021-x64
9Ransomware...KB.exe
windows11-21h2-x64
9Ransomware...KB.ps1
windows11-21h2-x64
10Ransomware...KB.ps1
windows7-x64
10Ransomware...KB.ps1
windows10-2004-x64
10Ransomware...KB.ps1
windows10-ltsc_2021-x64
10Ransomware...KB.ps1
windows11-21h2-x64
10Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10Analysis
-
max time kernel
33s -
max time network
11s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/03/2025, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win7-20241010-en
Behavioral task
behavioral3
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral5
Sample
RansomwareSamples/MAKOP_27_10_2020_115KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral6
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral7
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
RansomwareSamples/MedusaLocker_24_04_2020_661KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral11
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win7-20250207-en
Behavioral task
behavioral13
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral14
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral15
Sample
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral16
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
RansomwareSamples/Nefilim_31_08_2020_3061KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral21
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win11-20250314-en
Behavioral task
behavioral22
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win7-20241023-en
Behavioral task
behavioral23
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral24
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral25
Sample
RansomwareSamples/Nemty_03_02_2021_124KB.exe
Resource
win11-20250313-en
Behavioral task
behavioral26
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win11-20250313-en
Behavioral task
behavioral27
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral30
Sample
RansomwareSamples/NetWalker_19_10_2020_903KB.ps1
Resource
win11-20250313-en
General
-
Target
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
-
Size
200KB
-
MD5
c2671bf5b5dedbfd3cfe3f0f944fbe01
-
SHA1
da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1
-
SHA256
226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2
-
SHA512
256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9
-
SSDEEP
1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\RecoveryManual.html
href="mailto:[email protected]">[email protected]</a><br>
Signatures
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Mountlocker family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4876 powershell.exe -
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification \??\c:\Users\Public\Libraries\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini MountLocker_20_11_2020_200KB.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\f: MountLocker_20_11_2020_200KB.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedge_100_percent.pak MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\video_chroma\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\bun.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\editvideoimage.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat.DATA MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\CHANGELOG.md MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\pt-BR.pak MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Java\jre-1.8\lib\ext\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\sq.pak MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Common Files\DESIGNER\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageProviderFunctions.psm1 MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\README.md MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_removeme-default_18.svg MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sv-se\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\nunit_schema_2.5.xsd MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\ca.pak.DATA MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adc_logo.png MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\de-de\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\ui-strings.js MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_24.svg MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\RecoveryManual.html MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms MountLocker_20_11_2020_200KB.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo MountLocker_20_11_2020_200KB.exe File created \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\RecoveryManual.html MountLocker_20_11_2020_200KB.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MountLocker_20_11_2020_200KB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\.EF9E23B4\shell\Open\command MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\.EF9E23B4 MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\.EF9E23B4\shell MountLocker_20_11_2020_200KB.exe Key created \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\.EF9E23B4\shell\Open MountLocker_20_11_2020_200KB.exe Set value (str) \REGISTRY\USER\S-1-5-21-3712238951-2226310826-298817577-1000_Classes\.EF9E23B4\shell\Open\command\ = "explorer.exe RecoveryManual.html" MountLocker_20_11_2020_200KB.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4876 powershell.exe 4876 powershell.exe 4876 powershell.exe 4876 powershell.exe 4876 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4876 powershell.exe Token: SeTakeOwnershipPrivilege 4220 MountLocker_20_11_2020_200KB.exe Token: SeRestorePrivilege 4220 MountLocker_20_11_2020_200KB.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4220 MountLocker_20_11_2020_200KB.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4220 wrote to memory of 4876 4220 MountLocker_20_11_2020_200KB.exe 83 PID 4220 wrote to memory of 4876 4220 MountLocker_20_11_2020_200KB.exe 83 PID 4220 wrote to memory of 4876 4220 MountLocker_20_11_2020_200KB.exe 83 PID 4220 wrote to memory of 5820 4220 MountLocker_20_11_2020_200KB.exe 86 PID 4220 wrote to memory of 5820 4220 MountLocker_20_11_2020_200KB.exe 86 PID 4220 wrote to memory of 5820 4220 MountLocker_20_11_2020_200KB.exe 86 PID 5820 wrote to memory of 4768 5820 cmd.exe 89 PID 5820 wrote to memory of 4768 5820 cmd.exe 89 PID 5820 wrote to memory of 4768 5820 cmd.exe 89 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4768 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden -c $mypid='4220';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~240608078.tmp')|iex2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E57DEF6.bat" "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD520a4e982b05e61df8083065b2ccb2340
SHA10745d4292c8339fad60d68f7e427d3d3b5fb92d1
SHA25611579974bf043c4f2e84473a80e1ee103c255b6b8207130c48118a58084ba8ee
SHA512996a24105a305f65602b97cf85775cdd8e6472879b823d077df0dc622c14db1c18dca06bf2ec00bcb1abdbd607eee346edfde297be93ee29504f7ede7adc2ecf
-
Filesize
65B
MD5348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD54e1a1e3e715c291c71950d2fdc79e2be
SHA1dc2b3d20a9ec88e0d8d75c5097154687acc42983
SHA256acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39
SHA512d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80