Analysis
-
max time kernel
850s -
max time network
901s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-08-2021 05:46
General
-
Target
e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877.exe
-
Size
151KB
-
MD5
123511227718f17b3dec5431d5ae87f3
-
SHA1
307088ae7027b55541311fd70a9337ff3709fccf
-
SHA256
e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877
-
SHA512
182a45c60c0c14d55e40c7941836d7d658623a66ce7760eb71d8836ffa7974a0d1d3132b919fad921abecc9215ce458f06e563417c70682a9935a02d8053b234
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\Restore-My-Files.txt
Family
lockbit
Ransom Note
All your important files are encrypted!
Any attempts to restore your files with the thrid-party software will be fatal for your files!
RESTORE YOU DATA POSIBLE ONLY BUYING private key from us.
There is only one way to get your files back:
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?805244B9FB48720EC061B39958293273
This link only works in Tor Browser!
| 3. Follow the instructions on this page
### Attention! ###
# Do not rename encrypted files.
# Do not try to decrypt using third party software, it may cause permanent data loss.
# Decryption of your files with the help of third parties may cause increased price(they add their fee to our).
# Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN.
# Tor Browser user manual https://tb-manual.torproject.org/about
!!! We also download huge amount of your private data, including finance information, clients personal info, network diagrams, passwords and so on.
Don't forget about GDPR.
URLs
http://lockbitks2tvnmwk.onion/?805244B9FB48720EC061B39958293273
Extracted
Path
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\Restore-My-Files.txt
Ransom Note
��+~ʼnv��R����8�}�\D��㰻�
1� Kj�������M�9drؑ��t nb
?G>N/E��.4`Oi��Y��%sҫ�W�B_L��M�� �7��. �H4躐? ��~�+ ��s38V���tgTTu ���9Ӿ�P�qa��������������"ѷ�����<�u ڪ��/{,�� �<{Y�ǣ�b:X �1�� ��U��K��?���h��QГ� ��o��kwk{��(����;.s�@��&�β�N�w_�7���c}��=���y���cg�����1W�SQ�4g�ş���$��QeX���\?T��0z�u���pm}e��\m��9��P?��w0ۮzg��K��K�(=ţzM�]k�Ǘ��E��U^>C�Xd� ?�Q dǜ}o듁���P�8�ߵG�}�RUHA�����@�4�&��G�T������"�Fe< �@��β >����
�X�G�G#���
�0U� W�h)5�/�۵2�H�!��} y�*�2nR��B5�B#�/N�U&��^ D�0R���~�b�:�� ���J���OɠA���� y USsd�&q-�qe�r�ѝW\��� N��2�Ħ{�y�<X�+��S�5�r���o�i+[���� W2Cwzx+��D�R/��.� � �l49��r���m��얱�����Q1�jmp�����b]N���U;�����"#��
#-ƣF��7Nf��s;�'5��f��� x�1e�4 �r��.��$��:��� ,2���Fv�dk���,'��
��AgF!��.��`�F�
��C/h��sF�)6br�ɓo�:��
!k��!�Lb�F1Q��?6: ?gˌ��Q��C�w#ݱ��<�=��݅\�֙8���J�Ya���,&�# ���C^�N?��f"A��U���"W6�d�#��qg�Դ��އ�b��.mg?E���긋O�<1�?*l��1�l)�?�~�H�H�A
�|GsSC�.9LN��{�b�$abL1q������A�Y��<����"%��J�m��@����c��7$*��h�����yk�3�� ���� �!���9\���r��dE>���<��'�E�g�A6���9m��0T�h8V����B~6��!� �+�Z���lծoR�\��k�t����k�d:jЇ��� S�� =���BgGv������jѭ*���!l-�!�U�;�� �����i�)I���݃"{��u�}�KD9��u�(���OOz�Q�9��O[�m��,f�Gh�����c� xCL�Qb��h�������"Ig9r�
�eņR��I��������� "wX�\�ü��#o&�N��,;��ɪ$�w�*�x�)6dW*�x5!wܴ�h�����O^X|`�́�B����� ���53Y�Xu
��z ��_ gfI�un u~;dʭ�$�+xi�,jE�Zg����������A��-7p�0�ؖ��G�~�*�v%��R�a�B�v��c} ���
�l�����H�F�R2�#���3B��kP�U�ّg9�RD��Hr�1n��28xAll your important files are encrypted!
Any attempts to restore your files with the thrid-party software will be fatal for your files!
RESTORE YOU DATA POSIBLE ONLY BUYING private key from us.
There is only one way to get your files back:
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?805244B9FB48720EC061B39958293273
This link only works in Tor Browser!
| 3. Follow the instructions on this page
### Attention! ###
# Do not rename encrypted files.
# Do not try to decrypt using third party software, it may cause permanent data loss.
# Decryption of your files with the help of third parties may cause increased price(they add their fee to our).
# Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN.
# Tor Browser user manual https://tb-manual.torproject.org/about
!!! We also download huge amount of your private data, including finance information, clients personal info, network diagrams, passwords and so on.
Don't forget about GDPR.
URLs
http://lockbitks2tvnmwk.onion/?805244B9FB48720EC061B39958293273
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877.exe"C:\Users\Admin\AppData\Local\Temp\e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1032-60-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1328-62-0x0000000000000000-mapping.dmp
-
memory/1744-61-0x0000000000000000-mapping.dmp
-
memory/1872-63-0x0000000000000000-mapping.dmp
-
memory/2724-64-0x0000000000000000-mapping.dmp
-
memory/2736-65-0x0000000000000000-mapping.dmp
-
memory/2748-66-0x0000000000000000-mapping.dmp
-
memory/2748-67-0x000007FEFB991000-0x000007FEFB993000-memory.dmpFilesize
8KB