mountlocker | c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

max time kernel
431s
max time network
440s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
31/03/2025, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RansomwareSamples/MountLocker_20_11_2020_200KB.exe
Size 200KB
Sample250331-apdw1ssjs8
SHA256 226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2
MD5 c2671bf5b5dedbfd3cfe3f0f944fbe01
SHA1 da3e830011e6f9d41dd6c93fdb48c47c1c6e35e1
SHA512 256bc8582cc9b53b3cf9307a2882117476648ab9df540d501fc5f46a4030beacab9df2019f2d83b0a63d510803cbf6cbae01dc1325588f93a1a74521a07fe4d9
SSDEEP 1536:ssBoz9GFuIdclwKfVPoawSL20mRbg2DrE1mHkrY0f3r6fR0ZzDWR+3itGSh6ZVvg:ssS3oifBoaXhDWA4G3eeJaeIbmC00
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mountlocker discovery execution ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> aa0a8ea69e22c4a789b451ab4101d8502680b01accb901c9e00577a9cc00a122 </pre> <hr/> /!\ YOUR NETWORK HAS BEEN HACKED /!\ All your important files have been encrypted! <hr/> Your files are safe! Only encrypted. ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. You can send us 2-3 files and we will decrypt it for free to prove we are able to give your files back. Also we gathered highly confidential/personal data from your network. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you won't pay, we will release your data to public or reseller. So you can expect your data to be published or improperly used in the near future. In this case you will face all legal and reputational consequences of the leak. We only desire to get a ransom and we don't aim to damage your reputation or destroy your business. <hr/> Contact us to discuss your next step. <a href="http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502680b01accb901c9e00577a9cc00a122">http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502680b01accb901c9e00577a9cc00a122</a> * Note that this server is only available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "http://soxbhgx23tabwh2k447b2tljcu5tktdc2elmi2ls7huzntrhknygxsqd.onion/?cid=aa0a8ea69e22c4a789b451ab4101d8502680b01accb901c9e00577a9cc00a122". 4. Start a chat and follow the further instructions. (Password field should be empty for the first login). <hr/> If you can`t use the above link, use the email: <a href="mailto:[email protected]">[email protected]</a> Please note, sometimes our support is away from keyboard, but we will reply shortly. Kindly advise you to contact us as soon as possible. </body> </html>

Emails

href="mailto:[email protected]">[email protected]</a>

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker
Mountlocker family
mountlocker

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2936	powershell.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Desktop\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Documents\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Favorites\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Downloads\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\3D Objects\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Downloads\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Links\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Music\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Searches\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Videos\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Libraries\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Music\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\OneDrive\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Contacts\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Favorites\Links\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Admin\Saved Games\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\AccountPictures\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Pictures\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Videos\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Desktop\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\desktop.ini	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Users\Public\Documents\desktop.ini	MountLocker_20_11_2020_200KB.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\f:	MountLocker_20_11_2020_200KB.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.92\Locales\lv.pak	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.strings.psd1	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.92\identity_proxy\win10\identity_helper.Sparse.Beta.msix	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sqlpdw.xsl	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ja-jp\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\sqloledb.rll	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office15\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-gb\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\kk.pak	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\sl.txt	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psm1	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\resources.jar	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_duplicate_18.svg	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zCon.sfx	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\ui-strings.js	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\icudtl.dat	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\tt.txt	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_sv_135x40.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeGreaterThan.snippets.ps1xml	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\lv.pak	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\va.txt	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms	MountLocker_20_11_2020_200KB.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\RecoveryManual.html	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\security\blacklist	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_pdf_18.svg	MountLocker_20_11_2020_200KB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_proxy\resources.pri	MountLocker_20_11_2020_200KB.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MountLocker_20_11_2020_200KB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\.EF9E23B4\shell\Open\command	MountLocker_20_11_2020_200KB.exe
Key created	\REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\.EF9E23B4	MountLocker_20_11_2020_200KB.exe
Key created	\REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\.EF9E23B4\shell	MountLocker_20_11_2020_200KB.exe
Key created	\REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\.EF9E23B4\shell\Open	MountLocker_20_11_2020_200KB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-809364120-1453366396-340093129-1000_Classes\.EF9E23B4\shell\Open\command\ = "explorer.exe RecoveryManual.html"	MountLocker_20_11_2020_200KB.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2936	powershell.exe
2936	powershell.exe
2936	powershell.exe
2936	powershell.exe
2936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeTakeOwnershipPrivilege	4188	MountLocker_20_11_2020_200KB.exe
Token: SeRestorePrivilege	4188	MountLocker_20_11_2020_200KB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4188	MountLocker_20_11_2020_200KB.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2936	4188	MountLocker_20_11_2020_200KB.exe	82
PID 4188 wrote to memory of 2936	4188	MountLocker_20_11_2020_200KB.exe	82
PID 4188 wrote to memory of 2936	4188	MountLocker_20_11_2020_200KB.exe	82
PID 4188 wrote to memory of 2800	4188	MountLocker_20_11_2020_200KB.exe	86
PID 4188 wrote to memory of 2800	4188	MountLocker_20_11_2020_200KB.exe	86
PID 4188 wrote to memory of 2800	4188	MountLocker_20_11_2020_200KB.exe	86
PID 2800 wrote to memory of 2348	2800	cmd.exe	88
PID 2800 wrote to memory of 2348	2800	cmd.exe	88
PID 2800 wrote to memory of 2348	2800	cmd.exe	88
PID 4980 wrote to memory of 4884	4980	explorer.exe	99
PID 4980 wrote to memory of 4884	4980	explorer.exe	99
PID 4884 wrote to memory of 5148	4884	msedge.exe	101
PID 4884 wrote to memory of 5148	4884	msedge.exe	101
PID 5468 wrote to memory of 4664	5468	explorer.exe	107
PID 5468 wrote to memory of 4664	5468	explorer.exe	107

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2348	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe
"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden -c $mypid='4188';[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~240622250.tmp')|iex
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E5832F2.bat" "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\MountLocker_20_11_2020_200KB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2348

C:\Windows\explorer.exe
"explorer.exe" RecoveryManual.html
1⤵
PID:4932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RecoveryManual.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\RecoveryManual.html
    3⤵
    PID:5148

C:\Windows\explorer.exe
"explorer.exe" RecoveryManual.html
1⤵
PID:3736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RecoveryManual.html
  2⤵
  PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RecoveryManual.html

Path C:\Program Files\7-Zip\Lang\RecoveryManual.html
Size 2KB
SHA256 14859ec6d1309fcc90f16707d0d2af1c0ed772cacc04e3f5741649c36a9564f8
MD5 5b760db713563463a8c41cfb440cdb0c
SHA1 ba6fe624f7029134dd8dc45765c86b9e69816cef
SHA512 3670334ca59ccd2cf0b36bd5b72def3ec85dd6cf2818eed09fb786214ab1633962b876840a965e7255ebe8f33bbf60dffc0073c912fb22304a8ba0a220566d00
MD5 SHA1 SHA512

Submit Download

0E5832F2.bat

Path C:\Users\Admin\AppData\Local\Temp\0E5832F2.bat
Size 65B
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_j44run4z.a5q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j44run4z.a5q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

~240622250.tmp

Path C:\Users\Admin\AppData\Local\Temp\~240622250.tmp
Size 4KB
SHA256 acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39
MD5 4e1a1e3e715c291c71950d2fdc79e2be
SHA1 dc2b3d20a9ec88e0d8d75c5097154687acc42983
SHA512 d1be9f6459c248a93c95cc40a68e60ca2fe8068ff4ed5d442437a72bcc09ebf8568e3338d39abebbf3fe8e9e4e3a21a58e1ed6bdbcdd0a3b2ca46b6a81597d80
SSDEEP 96:VdPu3eXR6UnoGF51/GFHVB9en6Qf3Kil2T+FntL+ltuTz3kOOCpLx/ep9u+kxTU1:VdmOznoG/1u1VxBi1itovpLxGQ0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2936-66-0x0000000008060000-0x000000000806E000-memory.dmp

Download

memory/2936-68-0x00000000080C0000-0x00000000080DA000-memory.dmp

Download

memory/2936-47-0x0000000007D50000-0x0000000007D82000-memory.dmp

Download

memory/2936-77-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-74-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-73-0x0000000008F00000-0x00000000094A6000-memory.dmp

Download

memory/2936-72-0x00000000080E0000-0x0000000008102000-memory.dmp

Download

memory/2936-71-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-70-0x00000000744CE000-0x00000000744CF000-memory.dmp

Download

memory/2936-46-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-69-0x00000000080B0000-0x00000000080B8000-memory.dmp

Download

memory/2936-45-0x0000000006FF0000-0x000000000700A000-memory.dmp

Download

memory/2936-23-0x00000000744CE000-0x00000000744CF000-memory.dmp

Download

memory/2936-24-0x0000000003440000-0x0000000003476000-memory.dmp

Download

memory/2936-25-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-26-0x0000000005CA0000-0x000000000636A000-memory.dmp

Download

memory/2936-27-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-28-0x0000000005A60000-0x0000000005A82000-memory.dmp

Download

memory/2936-29-0x0000000005C00000-0x0000000005C66000-memory.dmp

Download

memory/2936-30-0x00000000064A0000-0x0000000006506000-memory.dmp

Download

memory/2936-67-0x0000000008080000-0x0000000008094000-memory.dmp

Download

memory/2936-40-0x0000000006510000-0x0000000006867000-memory.dmp

Download

memory/2936-41-0x00000000069D0000-0x00000000069EE000-memory.dmp

Download

memory/2936-42-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

Download

memory/2936-65-0x0000000008010000-0x0000000008021000-memory.dmp

Download

memory/2936-44-0x00000000082D0000-0x000000000894A000-memory.dmp

Download

memory/2936-64-0x0000000008120000-0x00000000081B6000-memory.dmp

Download

memory/2936-63-0x0000000007EC0000-0x0000000007ECA000-memory.dmp

Download

memory/2936-48-0x0000000070770000-0x00000000707BC000-memory.dmp

Download

memory/2936-59-0x0000000007D90000-0x0000000007DAE000-memory.dmp

Download

memory/2936-60-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-62-0x00000000744C0000-0x0000000074C71000-memory.dmp

Download

memory/2936-61-0x0000000007DC0000-0x0000000007E63000-memory.dmp

Download

memory/4188-8-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4188-80-0x0000000002CA0000-0x0000000002CAF000-memory.dmp

Download

memory/4188-4-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-15-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-2-0x000000000041A000-0x000000000041B000-memory.dmp

Download

memory/4188-14-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-17-0x0000000002CA0000-0x0000000002CAF000-memory.dmp

Download

memory/4188-9-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-49-0x000000000041A000-0x000000000041B000-memory.dmp

Download

memory/4188-6-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-10-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-7-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-11-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-12-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-13-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-79-0x0000000002CA0000-0x0000000002CAF000-memory.dmp

Download

memory/4188-78-0x0000000002CA0000-0x0000000002CAF000-memory.dmp

Download

memory/4188-5-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download

memory/4188-9353-0x0000000002CA0000-0x0000000002CAF000-memory.dmp

Download

memory/4188-3-0x0000000002C90000-0x0000000002C92000-memory.dmp

Download