Overview

overview

10

Static

static

8

a926fe9fc3...e0.exe

windows7_x64

10

a926fe9fc3...e0.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    22-09-2021 12:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0.exe

  • Size

    250KB

  • MD5

    ef37842fc159631f9dd8f94c5e05a674

  • SHA1

    07e19dd6f2b5ebe86614251860a067012d2a0ce9

  • SHA256

    a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0

  • SHA512

    e45235cea10568547a0cf9b3c3d5550eb76a67ebd950dad17bbd4fb1e441c9f904e7c6c0e268e1a8a8d6374de229bd0f096f4b45983febf6237987823ced00a4

Score
10/10
lockfileransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\LOCKFILE-README.hta

Family

lockfile

Ransom Note
LOCK FILE Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: contact us qTox ID: B2F873769EB6B508EBC2103DDEB7366CEFB7B09AB8314DAD0C4346169072686690489B47EAEB https://tox.chat/download.html Email: [email protected] Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion This link only works in Tor Browser! Follow the instructions on this page Do not try to recover files yourself. this process can damage your data and recovery will become impossible Do not rename encrypted files. Do not waste time trying to find the solution on the Internet. The longer you wait, the higher will become the decryption key price Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Thanks to the warning wallpaper provided by lockbit, it's easy to use
URLs

https://tox.chat/download.html

http://zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion

Signatures

  • LockFile

    LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.

    ransomwarelockfile
  • Drops file in Drivers directory 18 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Kills process with WMI 9 IoCs
    evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0.exe
    "C:\Users\Admin\AppData\Local\Temp\a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmwp%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vmwp%'" call terminate
        3⤵
        • Kills process with WMI
        • Suspicious use of AdjustPrivilegeToken
        PID:2668
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%virtualbox%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%virtualbox%'" call terminate
        3⤵
        • Kills process with WMI
        • Suspicious use of AdjustPrivilegeToken
        PID:2640
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vbox%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vbox%'" call terminate
        3⤵
        • Kills process with WMI
        PID:992
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%sqlservr%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%sqlservr%'" call terminate
        3⤵
        • Kills process with WMI
        PID:504
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%mysqld%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%mysqld%'" call terminate
        3⤵
        • Kills process with WMI
        PID:368
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%omtsreco%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3328
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%omtsreco%'" call terminate
        3⤵
        • Kills process with WMI
        PID:1960
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%oracle%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%oracle%'" call terminate
        3⤵
        • Kills process with WMI
        PID:640
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%tnslsnr%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:672
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%tnslsnr%'" call terminate
        3⤵
        • Kills process with WMI
        PID:3896
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmware%'" call terminate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic process where "name like '%vmware%'" call terminate
        3⤵
        • Kills process with WMI
        PID:3992
    • C:\Windows\SYSTEM32\mshta.exe
      mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
        PID:1104
      • C:\Windows\SYSTEM32\mshta.exe
        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
          PID:652
        • C:\Windows\SYSTEM32\mshta.exe
          mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          2⤵
            PID:808
          • C:\Windows\SYSTEM32\mshta.exe
            mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
            2⤵
              PID:804
            • C:\Windows\SYSTEM32\mshta.exe
              mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              2⤵
                PID:3264
              • C:\Windows\SYSTEM32\mshta.exe
                mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                2⤵
                  PID:672
                • C:\Windows\SYSTEM32\mshta.exe
                  mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                  2⤵
                    PID:4040
                  • C:\Windows\SYSTEM32\mshta.exe
                    mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                    2⤵
                      PID:3300
                    • C:\Windows\SYSTEM32\mshta.exe
                      mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                      2⤵
                        PID:792
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd /c ping 127.0.0.1 -n 5 && del "C:\Users\Admin\AppData\Local\Temp\a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0.exe" && exit
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1384
                        • C:\Windows\system32\PING.EXE
                          ping 127.0.0.1 -n 5
                          3⤵
                          • Runs ping.exe
                          PID:3744
                      • C:\Windows\SYSTEM32\mshta.exe
                        mshta "C:\Users\Public\LOCKFILE-README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                        2⤵
                          PID:3860

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads