Overview

overview

10

Static

static

8

2a23fac4cf...in.exe

windows7_x64

10

2a23fac4cf...in.exe

windows10_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    28-08-2021 23:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin.exe

  • Size

    250KB

  • MD5

    1f0a89360bb9471af8b2b1136eafd65f

  • SHA1

    a7bd3592ff31c5c659cda9810936ddce842d6590

  • SHA256

    2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a

  • SHA512

    c696ee6a3a65cf01f120724c8536d14bbdc5283e6a62e1a26454629ea30c4015d62c1ba6139ca158f9952d6028ea7d9a1f76a4d2adad4e3a377d06607f5ad031

Score
10/10
lockfileransomwarespywarestealer

Malware Config

Signatures

  • LockFile

    LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.

    ransomwarelockfile
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Kills process with WMI 9 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmwp%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vmwp%'" call terminate
        3⤵
        • Kills process with WMI
        • Suspicious use of AdjustPrivilegeToken
        PID:3180
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%virtualbox%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3856
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%virtualbox%'" call terminate
        3⤵
        • Kills process with WMI
        • Suspicious use of AdjustPrivilegeToken
        PID:3616
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vbox%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vbox%'" call terminate
        3⤵
        • Kills process with WMI
        PID:512
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%sqlservr%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%sqlservr%'" call terminate
        3⤵
        • Kills process with WMI
        PID:3672
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%mysqld%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%mysqld%'" call terminate
        3⤵
        • Kills process with WMI
        PID:2180
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%omtsreco%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%omtsreco%'" call terminate
        3⤵
        • Kills process with WMI
        PID:3052
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%oracle%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3868
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%oracle%'" call terminate
        3⤵
        • Kills process with WMI
        PID:2112
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%tnslsnr%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%tnslsnr%'" call terminate
        3⤵
        • Kills process with WMI
        PID:3160
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmware%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3244
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vmware%'" call terminate
        3⤵
        • Kills process with WMI
        PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/512-119-0x0000000000000000-mapping.dmp
    Download
  • memory/972-131-0x0000000000000000-mapping.dmp
    Download
  • memory/2112-127-0x0000000000000000-mapping.dmp
    Download
  • memory/2180-123-0x0000000000000000-mapping.dmp
    Download
  • memory/2284-128-0x0000000000000000-mapping.dmp
    Download
  • memory/2624-120-0x0000000000000000-mapping.dmp
    Download
  • memory/2940-122-0x0000000000000000-mapping.dmp
    Download
  • memory/3052-125-0x0000000000000000-mapping.dmp
    Download
  • memory/3160-129-0x0000000000000000-mapping.dmp
    Download
  • memory/3180-115-0x0000000000000000-mapping.dmp
    Download
  • memory/3244-130-0x0000000000000000-mapping.dmp
    Download
  • memory/3344-124-0x0000000000000000-mapping.dmp
    Download
  • memory/3616-117-0x0000000000000000-mapping.dmp
    Download
  • memory/3672-121-0x0000000000000000-mapping.dmp
    Download
  • memory/3856-116-0x0000000000000000-mapping.dmp
    Download
  • memory/3868-126-0x0000000000000000-mapping.dmp
    Download
  • memory/3940-114-0x0000000000000000-mapping.dmp
    Download
  • memory/3992-118-0x0000000000000000-mapping.dmp
    Download