Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

25/03/2025, 15:11

250325-skmbpsxzaw 10

25/03/2025, 15:06

250325-sg1d6a1px2 10

25/03/2025, 15:01

250325-sd5jpsxyct 10

25/03/2025, 14:56

250325-sbdcfaxxgs 10

25/03/2025, 14:50

250325-r7ve6a1nv3 10

25/03/2025, 14:46

250325-r5ab7sxwhx 10

25/03/2025, 14:40

250325-r2c9paxwe1 10

05/02/2025, 10:25

250205-mgcefaslhw 10

05/02/2025, 10:17

250205-mbs51atmbk 10

05/02/2025, 09:15

250205-k785zs1pfn 10

Analysis

  • max time kernel
    33s
  • max time network
    11s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/03/2025, 14:56

General

  • Target

    RansomwareSamples/MountLocker_20_11_2020_200KB.exe

  • Size

    200KB

  • MD5

    c2671bf5b5dedbfd3cfe3f0f944fbe01

  • SHA1

    da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1

  • SHA256

    226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2

  • SHA512

    256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9

  • SSDEEP

    1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\RecoveryManual.html

Ransom Note
<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <b> <pre> aa0a8ea69e22c4a789b451ab4101d850228eba0adcb510d2e00577a9cc00a142 </pre> </b> <hr/> <b>/!\ YOUR NETWORK HAS BEEN HACKED /!\<br> All your important files have been encrypted!</b><br> <hr/> Your files are safe! Only encrypted.<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> You can send us 2-3 files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> Also we gathered highly confidential/personal data from your network. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you won't pay, we will release your data to public or reseller.<br> So you can expect your data to be published or improperly used in the near future.<br> In this case you will face all legal and reputational consequences of the leak.<br> We only desire to get a ransom and we don't aim to damage your reputation or destroy<br> your business.<br><br> <hr/> <b>Contact us to discuss your next step.</b><br><br> <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850228eba0adcb510d2e00577a9cc00a142">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850228eba0adcb510d2e00577a9cc00a142</a><br> * Note that this server is only available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d850228eba0adcb510d2e00577a9cc00a142". <br> 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <br><br> <hr/> <b>If you can`t use the above link, use the email:</b><br> <a href="mailto:[email protected]">[email protected]</a><br> Please note, sometimes our support is away from keyboard, but we will reply shortly.<br> Kindly advise you to contact us as soon as possible.<br></b><br> </body> </html>
Emails

href="mailto:[email protected]">[email protected]</a><br>

Signatures

  • MountLocker Ransomware

    Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.

  • Mountlocker family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Drops desktop.ini file(s) 27 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden -c $mypid='4220';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~240608078.tmp')|iex
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4876
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E57DEF6.bat" "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5820
      • C:\Windows\SysWOW64\attrib.exe
        attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Lang\RecoveryManual.html

    Filesize

    2KB

    MD5

    20a4e982b05e61df8083065b2ccb2340

    SHA1

    0745d4292c8339fad60d68f7e427d3d3b5fb92d1

    SHA256

    11579974bf043c4f2e84473a80e1ee103c255b6b8207130c48118a58084ba8ee

    SHA512

    996a24105a305f65602b97cf85775cdd8e6472879b823d077df0dc622c14db1c18dca06bf2ec00bcb1abdbd607eee346edfde297be93ee29504f7ede7adc2ecf

  • C:\Users\Admin\AppData\Local\Temp\0E57DEF6.bat

    Filesize

    65B

    MD5

    348cae913e496198548854f5ff2f6d1e

    SHA1

    a07655b9020205bd47084afd62a8bb22b48c0cdc

    SHA256

    c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

    SHA512

    799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_isdxaisy.kqy.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\~240608078.tmp

    Filesize

    4KB

    MD5

    4e1a1e3e715c291c71950d2fdc79e2be

    SHA1

    dc2b3d20a9ec88e0d8d75c5097154687acc42983

    SHA256

    acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39

    SHA512

    d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80

  • memory/4220-4-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-18-0x0000000004870000-0x000000000487F000-memory.dmp

    Filesize

    60KB

  • memory/4220-11-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-10-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-8-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-7-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-6-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-5-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-2-0x000000000041A000-0x000000000041B000-memory.dmp

    Filesize

    4KB

  • memory/4220-3-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-16-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/4220-14-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-17-0x0000000004870000-0x000000000487F000-memory.dmp

    Filesize

    60KB

  • memory/4220-12-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-9276-0x0000000004870000-0x000000000487F000-memory.dmp

    Filesize

    60KB

  • memory/4220-13-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-74-0x0000000004870000-0x000000000487F000-memory.dmp

    Filesize

    60KB

  • memory/4220-76-0x0000000004870000-0x000000000487F000-memory.dmp

    Filesize

    60KB

  • memory/4220-75-0x0000000004870000-0x000000000487F000-memory.dmp

    Filesize

    60KB

  • memory/4220-62-0x000000000041A000-0x000000000041B000-memory.dmp

    Filesize

    4KB

  • memory/4220-15-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4220-9-0x0000000002EB0000-0x0000000002EB2000-memory.dmp

    Filesize

    8KB

  • memory/4876-40-0x0000000006700000-0x000000000674C000-memory.dmp

    Filesize

    304KB

  • memory/4876-29-0x00000000060C0000-0x0000000006126000-memory.dmp

    Filesize

    408KB

  • memory/4876-38-0x0000000006130000-0x0000000006487000-memory.dmp

    Filesize

    3.3MB

  • memory/4876-42-0x0000000007E00000-0x000000000847A000-memory.dmp

    Filesize

    6.5MB

  • memory/4876-43-0x0000000006BC0000-0x0000000006BDA000-memory.dmp

    Filesize

    104KB

  • memory/4876-45-0x0000000074D90000-0x0000000075541000-memory.dmp

    Filesize

    7.7MB

  • memory/4876-44-0x0000000007980000-0x00000000079B4000-memory.dmp

    Filesize

    208KB

  • memory/4876-46-0x0000000071000000-0x000000007104C000-memory.dmp

    Filesize

    304KB

  • memory/4876-55-0x00000000079E0000-0x00000000079FE000-memory.dmp

    Filesize

    120KB

  • memory/4876-57-0x0000000074D90000-0x0000000075541000-memory.dmp

    Filesize

    7.7MB

  • memory/4876-56-0x0000000007A00000-0x0000000007AA4000-memory.dmp

    Filesize

    656KB

  • memory/4876-58-0x0000000074D90000-0x0000000075541000-memory.dmp

    Filesize

    7.7MB

  • memory/4876-59-0x0000000007B00000-0x0000000007B0A000-memory.dmp

    Filesize

    40KB

  • memory/4876-60-0x0000000007D50000-0x0000000007DE6000-memory.dmp

    Filesize

    600KB

  • memory/4876-61-0x0000000007C60000-0x0000000007C71000-memory.dmp

    Filesize

    68KB

  • memory/4876-39-0x00000000066D0000-0x00000000066EE000-memory.dmp

    Filesize

    120KB

  • memory/4876-63-0x0000000007CB0000-0x0000000007CBE000-memory.dmp

    Filesize

    56KB

  • memory/4876-64-0x0000000007CC0000-0x0000000007CD5000-memory.dmp

    Filesize

    84KB

  • memory/4876-65-0x0000000007D10000-0x0000000007D2A000-memory.dmp

    Filesize

    104KB

  • memory/4876-66-0x0000000007D00000-0x0000000007D08000-memory.dmp

    Filesize

    32KB

  • memory/4876-67-0x0000000007D20000-0x0000000007D42000-memory.dmp

    Filesize

    136KB

  • memory/4876-68-0x0000000008A30000-0x0000000008FD6000-memory.dmp

    Filesize

    5.6MB

  • memory/4876-69-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

    Filesize

    4KB

  • memory/4876-70-0x0000000074D90000-0x0000000075541000-memory.dmp

    Filesize

    7.7MB

  • memory/4876-73-0x0000000074D90000-0x0000000075541000-memory.dmp

    Filesize

    7.7MB

  • memory/4876-28-0x00000000059C0000-0x0000000005A26000-memory.dmp

    Filesize

    408KB

  • memory/4876-27-0x0000000005820000-0x0000000005842000-memory.dmp

    Filesize

    136KB

  • memory/4876-26-0x0000000005A90000-0x00000000060BA000-memory.dmp

    Filesize

    6.2MB

  • memory/4876-25-0x0000000074D90000-0x0000000075541000-memory.dmp

    Filesize

    7.7MB

  • memory/4876-24-0x00000000031F0000-0x0000000003226000-memory.dmp

    Filesize

    216KB

  • memory/4876-23-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

    Filesize

    4KB