Resubmissions
17-05-2024 14:06
240517-reh7esbc83 1017-05-2024 14:05
240517-rdxnesbb2x 1017-05-2024 14:04
240517-rdkc4aba91 1017-05-2024 14:00
240517-raznlsbc33 1009-01-2022 14:18
220109-rl99gsdee2 10Analysis
-
max time kernel
5s -
max time network
2s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 14:04
Behavioral task
behavioral1
Sample
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
Resource
win10v2004-20240508-en
General
-
Target
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe
-
Size
66KB
-
MD5
2c26b319e378755596f0ac6d293798c8
-
SHA1
280a4cfcf5dd87898c3731b680efe061bdb7a9fe
-
SHA256
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99
-
SHA512
0c2b53a3fed1dbbae64e7f1e7c17a89b5dc607ba40caecd5496e18ffd84cdad844e926742d9fc82a715d6e8b01a1c483d97d54f5be1f2d6997107946f2a3fe4b
-
SSDEEP
768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADO2A:DaXq4xTlIdYrhRcH2A
Malware Config
Signatures
-
MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2760 cmd.exe -
Drops desktop.ini file(s) 32 IoCs
Processes:
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exedescription ioc process File opened for modification \??\c:\Users\Admin\Searches\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EQ2PZD61\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BB4W7M7Z\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2RM92H5V\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exedescription ioc process File opened (read-only) \??\f: 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe -
Drops file in Program Files directory 3 IoCs
Processes:
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exedescription ioc process File created \??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RecoveryManual.html 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File created \??\c:\Program Files\RecoveryManual.html 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe File created \??\c:\Program Files (x86)\RecoveryManual.html 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe -
Modifies registry class 5 IoCs
Processes:
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell\Open 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell\Open\command\ = "explorer.exe RecoveryManual.html" 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911\shell\Open\command 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.F30D4911 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exepid process 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exedescription pid process Token: SeRestorePrivilege 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe Token: SeDebugPrivilege 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.execmd.exedescription pid process target process PID 2196 wrote to memory of 2760 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe cmd.exe PID 2196 wrote to memory of 2760 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe cmd.exe PID 2196 wrote to memory of 2760 2196 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe cmd.exe PID 2760 wrote to memory of 864 2760 cmd.exe attrib.exe PID 2760 wrote to memory of 864 2760 cmd.exe attrib.exe PID 2760 wrote to memory of 864 2760 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F763276.bat" "C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.exe"3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\RecoveryManual.htmlFilesize
2KB
MD5c05a2821a9fc97a54568466d95a4ad92
SHA1f74925d9af5d063e61903d9856527c00911571d1
SHA256530af8a0154f6c632ccf0982ee8f22060bd8e3b3c66f38b9a7155a89b7a0e333
SHA5129a35b2cc667444f63491bfc5e69b1178e0137c64247358295c3abf136c0489aaa3480ba8a9afec4f3618ffec6ca20b63c0bd8782905bffe866251640038b1964
-
C:\Users\Admin\AppData\Local\Temp\0F763276.batFilesize
65B
MD5348cae913e496198548854f5ff2f6d1e
SHA1a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611