Overview

overview

10

Static

static

9

f3a8fbd973...8d.exe

windows7_x64

10

f3a8fbd973...8d.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    86s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    27-04-2022 17:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d.exe

  • Size

    627KB

  • MD5

    042227360a51cc44e56bae065eec9a90

  • SHA1

    85b0ec628c72b07e930a87158c73c71651def497

  • SHA256

    f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d

  • SHA512

    97dcb2c9df3f3d86faa64fec1e4377029ae3b8792fc1421e70cf971336aed885be0db6f48501c601780a790a3cb986686f04df2857899835dfc6d5582996723d

Score
10/10
lockbitevasionpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d.exe
    "C:\Users\Admin\AppData\Local\Temp\f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1136
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1948
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1808
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1464
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:1976
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta"
      2⤵
      • Modifies Internet Explorer settings
      PID:2972
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.7 -n 3
        3⤵
        • Runs ping.exe
        PID:3028
      • C:\Windows\SysWOW64\fsutil.exe
        fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d.exe"
        3⤵
          PID:1864
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1292
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1356
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:780
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:1600

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Command-Line Interface

        1
        T1059

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        File Deletion

        3
        T1107

        Modify Registry

        3
        T1112

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Remote System Discovery

        1
        T1018

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Inhibit System Recovery

        4
        T1490

        Defacement

        1
        T1491

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Desktop\LockBit-note.hta
          Filesize

          17KB

          MD5

          6bf15f46a763cde88388096d94aa8104

          SHA1

          a751807a81397e60ebadbe69cb41d64a082cf7c0

          SHA256

          fc18942b464bb34e8a23e438a453b44c206e911966a77aaf427a46b8c31ee21b

          SHA512

          9c2e61614bbc53e43174c65351b2a07eb67ecba0841feb16861ad382f1040d88511ddd16cdd5a8ae40e2594c68568767186e003f4bf12af3e29b28922efc3b1e

          Download Submit
        • memory/816-55-0x0000000000220000-0x0000000000246000-memory.dmp
          Filesize

          152KB

          Download
        • memory/816-56-0x0000000000400000-0x00000000004A7000-memory.dmp
          Filesize

          668KB

          Download
        • memory/816-54-0x0000000075B61000-0x0000000075B63000-memory.dmp
          Filesize

          8KB

          Download
        • memory/1136-58-0x0000000000000000-mapping.dmp
          Download
        • memory/1272-57-0x0000000000000000-mapping.dmp
          Download
        • memory/1464-61-0x0000000000000000-mapping.dmp
          Download
        • memory/1808-60-0x0000000000000000-mapping.dmp
          Download
        • memory/1864-68-0x0000000000000000-mapping.dmp
          Download
        • memory/1948-59-0x0000000000000000-mapping.dmp
          Download
        • memory/1976-62-0x0000000000000000-mapping.dmp
          Download
        • memory/1976-63-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp
          Filesize

          8KB

          Download
        • memory/2972-64-0x0000000000000000-mapping.dmp
          Download
        • memory/2988-65-0x0000000000000000-mapping.dmp
          Download
        • memory/3028-66-0x0000000000000000-mapping.dmp
          Download