Overview

overview

10

Static

static

8

l.exe

windows7_x64

10

l.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    l.exe
  • Size 151KB
  • Sample201129-dpqra6fxte
  • SHA256 ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62
  • MD5 SHA1 SHA512
Score
10/10
lockbitevasionpersistenceransomwareupx

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?85C01E35FD24495C88AAD1F998429CC4 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?85C01E35FD24495C88AAD1F998429CC4 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?85C01E35FD24495C88AAD1F998429CC4

  • http://lockbitks2tvnmwk.onion/?85C01E35FD24495C88AAD1F998429CC4

Extracted

Path

  • C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
  • Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?85C01E35FD24495C88AAD1F998429CC4 Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?85C01E35FD24495C88AAD1F998429CC4 This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?85C01E35FD24495C88AAD1F998429CC4

  • http://lockbitks2tvnmwk.onion/?85C01E35FD24495C88AAD1F998429CC4

Extracted

Path

  • C:\odt\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?85C01E35FD24495C95CCA707B0A7826A | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?85C01E35FD24495C95CCA707B0A7826A This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?85C01E35FD24495C95CCA707B0A7826A

  • http://lockbitks2tvnmwk.onion/?85C01E35FD24495C95CCA707B0A7826A

Extracted

Path

  • C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
  • Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?85C01E35FD24495C95CCA707B0A7826A Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?85C01E35FD24495C95CCA707B0A7826A This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?85C01E35FD24495C95CCA707B0A7826A

  • http://lockbitks2tvnmwk.onion/?85C01E35FD24495C95CCA707B0A7826A

Targets

    • Target
      l.exe
    • Size 151KB
    • SHA256 ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62
    • MD5 SHA1 SHA512
    Score
    10/10
    lockbitevasionpersistenceransomware

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks