Overview

overview

10

Static

static

c66519665d...6d.exe

windows7_x64

10

c66519665d...6d.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    18-04-2022 11:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe

  • Size

    445KB

  • MD5

    1a7eb7fc0b6c28388e1f1e3beab03892

  • SHA1

    0fdbdc0e8aa192f245ce68888012313c81a95be0

  • SHA256

    c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d

  • SHA512

    b08ad87c757236e1eaa3669c185610aae19c83ed51248d9bbeb7c5ded936d6ce45f7fe7fc71b9fdbec1fb2ace9bac397d0e72b3b885917a9f6f0030c8ecddc1d

Score
10/10
lockbitevasionpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43

http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43 Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43 This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43

http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe
    "C:\Users\Admin\AppData\Local\Temp\c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:816
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2036
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:556
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1332
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:1384
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta"
      2⤵
      • Modifies Internet Explorer settings
      PID:3040
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.7 -n 3
        3⤵
        • Runs ping.exe
        PID:2848
      • C:\Windows\SysWOW64\fsutil.exe
        fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d.exe"
        3⤵
          PID:1276
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1240
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1228
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:2764
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:2792

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Command-Line Interface

        1
        T1059

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        File Deletion

        3
        T1107

        Modify Registry

        3
        T1112

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Remote System Discovery

        1
        T1018

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Inhibit System Recovery

        4
        T1490

        Defacement

        1
        T1491

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Desktop\LockBit-note.hta
          Filesize

          17KB

          MD5

          d0dbcefd9d09b281aac111b695854370

          SHA1

          33a9a2c5177ce4a00300dd6e1de8bc6010bcefbe

          SHA256

          de1ec9f1c0b95d7163e042f7a03817c7e2b37edb5eac39d97204b93fa75a45f2

          SHA512

          f785aee13f7e1955ed9582c06a346152d95be40ae357af2e64140939e099b487f4bd61b74eeacdea2e2a6550acb44d84f690657fe9ddd91219ecd83af3c87151

          Download Submit
        • memory/556-61-0x0000000000000000-mapping.dmp
          Download
        • memory/816-56-0x0000000000000000-mapping.dmp
          Download
        • memory/968-54-0x0000000075B61000-0x0000000075B63000-memory.dmp
          Filesize

          8KB

          Download
        • memory/968-58-0x00000000001B0000-0x00000000001D6000-memory.dmp
          Filesize

          152KB

          Download
        • memory/968-57-0x00000000002B7000-0x00000000002CE000-memory.dmp
          Filesize

          92KB

          Download
        • memory/968-59-0x0000000000400000-0x000000000232C000-memory.dmp
          Filesize

          31.2MB

          Download
        • memory/1276-76-0x0000000000000000-mapping.dmp
          Download
        • memory/1332-62-0x0000000000000000-mapping.dmp
          Download
        • memory/1384-63-0x0000000000000000-mapping.dmp
          Download
        • memory/1384-64-0x000007FEFB721000-0x000007FEFB723000-memory.dmp
          Filesize

          8KB

          Download
        • memory/1428-55-0x0000000000000000-mapping.dmp
          Download
        • memory/2036-60-0x0000000000000000-mapping.dmp
          Download
        • memory/2848-67-0x0000000000000000-mapping.dmp
          Download
        • memory/3040-65-0x0000000000000000-mapping.dmp
          Download
        • memory/3056-66-0x0000000000000000-mapping.dmp
          Download