Overview

overview

10

Static

static

Lockbit.bin.exe

windows7_x64

10

Lockbit.bin.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.zip
  • Size 55KB
  • Sample200619-wq72cs2sqx
  • SHA256 8a550acacdbc1bf387189702f686a6b78d5fe08286f99165f4dee4cf7ce4b662
  • MD5 SHA1 SHA512
Score
10/10
lockbitevasionpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBCEB996649AC036A0 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our) # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBCEB996649AC036A0

Extracted

Path

  • C:\odt\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBBA0A23576F9C683E This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our) # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBBA0A23576F9C683E

Targets

    • Target
      Lockbit.bin
    • Size 101KB
    • SHA256 0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwareevasionlockbitpersistence

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes system backup catalog

      Ransomware often tries to delete backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Deletes itself

    • Adds Run entry to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

    • Modifies service

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks