Analysis
-
max time kernel
600s -
max time network
361s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
03-01-2022 04:32
General
-
Target
d4rkw4ve@tutanota.com.exe
-
Size
489KB
-
MD5
ad81961ccc571e985d35e6f30d396859
-
SHA1
39dc8ac32563d88a11dee49137a0353b46f3eb38
-
SHA256
630e24cc1c4c95321965ad967e77e1888c48c4b1f653d800c7df08e879814787
-
SHA512
2d08c947b382b8633c1e055a8bbc57ae7b83f9a3a3ea1ac38080c52acc3fb928a2e199588b8cb0160494be03e6d42d4ae414d292e9e3838a6850cde1369aa8d8
Malware Config
Extracted
C:\Restore-My-Files.txt
d4rkw4ve@tutanota.com
dark4wave@yandex.com
Extracted
C:\Users\Admin\AppData\Local\Temp\info.hta
d4rkw4ve@tutanota.com
dark4wave@yandex.com
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops startup file 3 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 29 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4rkw4ve@tutanota.com.exe"C:\Users\Admin\AppData\Local\Temp\d4rkw4ve@tutanota.com.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uvt5v2ad\uvt5v2ad.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA738.tmp" "c:\ProgramData\CSCD7D9D7DD0D34F968BC25FA8464381EE.TMP"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\452zjcpi.exeMD5
6456f1b47ac39df354a59db0c443f59a
SHA1b40af78de5e5be12df5c36c7785b2015102494ff
SHA256a99a166762c3f9b4e678828edbfd49e6acb32058fee7ea6f8b1abf89a73e6eb3
SHA512f226bce3d9df69f2de7c5cc52b9c86818d192ecfe33e6426bf0e83ff7e86550ade0c46698feba8fb617facacf0899f3f2e98bcb3a3453a186c3e06f3ed313ee9
-
C:\Users\Admin\AppData\Local\Temp\RESA738.tmpMD5
7a70a289f304044ef16b1306999dadec
SHA148690b8b0274940796dc1aa6e0b18e17c502ad37
SHA25629feaec6359970a80021d56227faa7981a06b436c3302681fe65076a15587d27
SHA512bdd85680faec149c395080c09eb2b82442ff213ce412ece6b535e2bfbb29093fb33e2255ed9e090faed77161b03d5eb93ec85c90e2f44315e868d51619b94a53
-
C:\Users\Admin\AppData\Local\Temp\info.htaMD5
b522d3b331849a376373afe80ba5d01d
SHA1d91732c6739dffe7abe5baf92278d8e90ec7f2ba
SHA256a444c957d451a810e3b18578e0dc23ddf479f02b233984cbb728316c9407e8bb
SHA512265d3bd0a41cfe7f40a903d1247b4d6ab6614bf4cbfb8d1e9e0c7afa9d4fdf3b59c83d9db4c80976e2123ef7ceba1919da9c2ec7f1e0b26935c8d018097cde2a
-
\??\c:\ProgramData\CSCD7D9D7DD0D34F968BC25FA8464381EE.TMPMD5
8abbdc6d926579b927ea394808f2c44f
SHA13144a2a1c3c9982a3a606a070983f98cea1a9f8e
SHA2562ae57feafcc8edafdf71de27cd5b21620a4fd8f35d642122cfd572606dfb3568
SHA51246b870c1de81d7694be07303017bf4b78dd03d12d82424caafdc431cae9ac39351c09f736a268d5e93ef8b8177878ccad64927e27699276fff86fee5958fbd73
-
\??\c:\Users\Admin\AppData\Local\Temp\ug5eoeim.icoMD5
dbc49b5f7714255217080c2e81f05a99
SHA14de2ef415d66d2bb8b389ba140a468b125388e19
SHA2566d2f1f6164cbd331b9dc43b37948372e21b2ee45407aa99e199693835cded09c
SHA51229a65eb7403bfc220fd057c2e6ea11b29bff545dfce2d3370ad462c66b03ae7f648efd480305423a49440de199a2a94c41214877b226a42dc2d1650683d149bb
-
\??\c:\Users\Admin\AppData\Local\Temp\uvt5v2ad\uvt5v2ad.0.csMD5
69ffa9cc03972f30e15f26cd9eb7dbb2
SHA103f489b2ec66958fea4b20ba75494298a72439fa
SHA256a5cdc42c009f51f7ba43c4ca635a801958baad7523847e3ca0e34135e3eb93c1
SHA5120eceed327c153917cad590a37754348808cb13d1cc5785e743deb97d00ccfeee62ba2e126108a6491380a03201b23e801feba3a2875b9a2f31e5376114fdf6de
-
\??\c:\Users\Admin\AppData\Local\Temp\uvt5v2ad\uvt5v2ad.cmdlineMD5
62e73cf5bbdc9bea434d4a0827542765
SHA1b81732c223be653f2a717d7a31c0977f18988467
SHA2564bb572e47c368089993926ca332669cdc1fcdb886bb2b59b062e475791ab85f2
SHA512c4cc4000b25c1c694fbf481bebe9485809f2341215c7d2641830faa6fc4ef4aa44ae678693cfa1089173cbd2c3c0ffcbe444c9813cb3de6bc0f6f6d49a59f967
-
memory/1256-145-0x0000000000000000-mapping.dmp
-
memory/2288-144-0x0000000000000000-mapping.dmp
-
memory/2324-143-0x0000000000000000-mapping.dmp
-
memory/2336-147-0x0000000000000000-mapping.dmp
-
memory/2492-139-0x0000000000000000-mapping.dmp
-
memory/3416-142-0x0000000000000000-mapping.dmp
-
memory/3476-119-0x0000000004F70000-0x0000000004F92000-memory.dmpFilesize
136KB
-
memory/3476-118-0x0000000005240000-0x00000000052B6000-memory.dmpFilesize
472KB
-
memory/3476-117-0x0000000005000000-0x0000000005066000-memory.dmpFilesize
408KB
-
memory/3476-116-0x00000000050A0000-0x0000000005132000-memory.dmpFilesize
584KB
-
memory/3476-115-0x0000000000740000-0x00000000007C4000-memory.dmpFilesize
528KB
-
memory/3476-120-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/3648-146-0x0000000000000000-mapping.dmp
-
memory/3824-141-0x0000000000000000-mapping.dmp
-
memory/4260-140-0x0000000000000000-mapping.dmp
-
memory/4436-121-0x0000000000000000-mapping.dmp
-
memory/4480-122-0x0000000000000000-mapping.dmp
-
memory/4500-123-0x0000000000000000-mapping.dmp
-
memory/4568-127-0x0000000000000000-mapping.dmp
-
memory/4760-131-0x0000000000000000-mapping.dmp
-
memory/4780-132-0x0000000000000000-mapping.dmp
-
memory/4804-133-0x0000000000000000-mapping.dmp
-
memory/4828-134-0x0000000000000000-mapping.dmp
-
memory/4860-135-0x0000000000000000-mapping.dmp
-
memory/4896-136-0x0000000000000000-mapping.dmp
-
memory/4964-137-0x0000000000000000-mapping.dmp
-
memory/5024-138-0x0000000000000000-mapping.dmp