Overview

overview

10

Static

static

8

2a23fac4cf...in.exe

windows7_x64

10

2a23fac4cf...in.exe

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    28-08-2021 23:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin.exe

  • Size

    250KB

  • MD5

    1f0a89360bb9471af8b2b1136eafd65f

  • SHA1

    a7bd3592ff31c5c659cda9810936ddce842d6590

  • SHA256

    2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a

  • SHA512

    c696ee6a3a65cf01f120724c8536d14bbdc5283e6a62e1a26454629ea30c4015d62c1ba6139ca158f9952d6028ea7d9a1f76a4d2adad4e3a377d06607f5ad031

Score
10/10
lockfileransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\LOCKFILE-README.hta

Family

lockfile

Ransom Note
LOCK FILE Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: contact us qTox ID: B2F873769EB6B508EBC2103DDEB7366CEFB7B09AB8314DAD0C4346169072686690489B47EAEB https://tox.chat/download.html Email: contact@contipauper.com Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion This link only works in Tor Browser! Follow the instructions on this page Do not try to recover files yourself. this process can damage your data and recovery will become impossible Do not rename encrypted files. Do not waste time trying to find the solution on the Internet. The longer you wait, the higher will become the decryption key price Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Thanks to the warning wallpaper provided by lockbit, it's easy to use
Emails

contact@contipauper.com

URLs

https://tox.chat/download.html

http://zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion

Signatures

  • LockFile

    LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.

    ransomwarelockfile
  • Drops file in Drivers directory 9 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Kills process with WMI 9 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmwp%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vmwp%'" call terminate
        3⤵
        • Kills process with WMI
        • Suspicious use of AdjustPrivilegeToken
        PID:2040
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%virtualbox%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1604
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%virtualbox%'" call terminate
        3⤵
        • Kills process with WMI
        • Suspicious use of AdjustPrivilegeToken
        PID:1608
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vbox%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vbox%'" call terminate
        3⤵
        • Kills process with WMI
        PID:268
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%sqlservr%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%sqlservr%'" call terminate
        3⤵
        • Kills process with WMI
        PID:572
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%mysqld%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:792
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%mysqld%'" call terminate
        3⤵
        • Kills process with WMI
        PID:584
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%omtsreco%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%omtsreco%'" call terminate
        3⤵
        • Kills process with WMI
        PID:1932
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%oracle%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%oracle%'" call terminate
        3⤵
        • Kills process with WMI
        PID:1836
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%tnslsnr%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%tnslsnr%'" call terminate
        3⤵
        • Kills process with WMI
        PID:380
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmware%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vmware%'" call terminate
        3⤵
        • Kills process with WMI
        PID:1432
    • C:\Windows\system32\mshta.exe
      mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • Modifies Internet Explorer settings
      PID:996
    • C:\Windows\system32\mshta.exe
      mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
        PID:1152
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1648
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1804
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1344
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1260
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1320
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1068
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1968
      • C:\Windows\system32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Modifies Internet Explorer settings
        PID:1340
      • C:\Windows\system32\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 && del "C:\Users\Admin\AppData\Local\Temp\2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin.exe" && exit
        2⤵
          PID:240
          • C:\Windows\system32\PING.EXE
            ping 127.0.0.1 -n 5
            3⤵
            • Runs ping.exe
            PID:1176

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Remote System Discovery

      1
      T1018

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\LOCKFILE-README.hta
        MD5

        eb158675e76fc2445e6763566d99a7c3

        SHA1

        f204da7d6e4c3aa5bfce08b3aa203b286eec972c

        SHA256

        2a46f52d5cab528f6b23fc1496945129a52ab7fc240a701529db7818e7a8d9e9

        SHA512

        78f017e88ad661cacf0b497903cc65e891c61b3cc651d72270852511dc5c7821fc21ead347e9e2d79c9d01876204fae2f4a08da7fcc46fa7342dcf58ad85fd55

        Download Submit
      • memory/112-70-0x0000000000000000-mapping.dmp
        Download
      • memory/240-88-0x0000000000000000-mapping.dmp
        Download
      • memory/268-65-0x0000000000000000-mapping.dmp
        Download
      • memory/380-75-0x0000000000000000-mapping.dmp
        Download
      • memory/572-67-0x0000000000000000-mapping.dmp
        Download
      • memory/584-69-0x0000000000000000-mapping.dmp
        Download
      • memory/588-64-0x0000000000000000-mapping.dmp
        Download
      • memory/792-68-0x0000000000000000-mapping.dmp
        Download
      • memory/996-78-0x0000000000000000-mapping.dmp
        Download
      • memory/1068-85-0x0000000000000000-mapping.dmp
        Download
      • memory/1104-72-0x0000000000000000-mapping.dmp
        Download
      • memory/1116-74-0x0000000000000000-mapping.dmp
        Download
      • memory/1152-79-0x0000000000000000-mapping.dmp
        Download
      • memory/1260-83-0x0000000000000000-mapping.dmp
        Download
      • memory/1320-89-0x000007FEFC031000-0x000007FEFC033000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1320-84-0x0000000000000000-mapping.dmp
        Download
      • memory/1340-87-0x0000000000000000-mapping.dmp
        Download
      • memory/1344-82-0x0000000000000000-mapping.dmp
        Download
      • memory/1432-77-0x0000000000000000-mapping.dmp
        Download
      • memory/1604-62-0x0000000000000000-mapping.dmp
        Download
      • memory/1608-63-0x0000000000000000-mapping.dmp
        Download
      • memory/1620-66-0x0000000000000000-mapping.dmp
        Download
      • memory/1648-80-0x0000000000000000-mapping.dmp
        Download
      • memory/1692-76-0x0000000000000000-mapping.dmp
        Download
      • memory/1804-81-0x0000000000000000-mapping.dmp
        Download
      • memory/1836-73-0x0000000000000000-mapping.dmp
        Download
      • memory/1932-71-0x0000000000000000-mapping.dmp
        Download
      • memory/1968-86-0x0000000000000000-mapping.dmp
        Download
      • memory/2028-60-0x0000000000000000-mapping.dmp
        Download
      • memory/2040-61-0x0000000000000000-mapping.dmp
        Download