General
-
Target
b4931c56a04ae78d1676c904e5074ec9e637bad4c0e6184102f97d8ad6e75b7e
-
Size
252KB
-
Sample
220512-r61ksahaa6
-
MD5
676a80221c30288c2bb8a26bfc549b9a
-
SHA1
1a03cadea471f4a5412628b2995c6e988b0c5073
-
SHA256
b4931c56a04ae78d1676c904e5074ec9e637bad4c0e6184102f97d8ad6e75b7e
-
SHA512
d5a0b68bf7702cce1992f7050e4af82ca2be64b0cb5525102fcccbbd14b1aae7ae59a762f368aeb500efc7d193f5507937f1a01f13bed5d3f76664adabf9ab4e
Static task
static1
Behavioral task
behavioral1
Sample
b4931c56a04ae78d1676c904e5074ec9e637bad4c0e6184102f97d8ad6e75b7e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b4931c56a04ae78d1676c904e5074ec9e637bad4c0e6184102f97d8ad6e75b7e.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?96B283EF5B7ACD4CBF37248AB20916DD
http://lockbitks2tvnmwk.onion/?96B283EF5B7ACD4CBF37248AB20916DD
Extracted
C:\odt\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?96B283EF5B7ACD4CA9A01F7006C0A55E
http://lockbitks2tvnmwk.onion/?96B283EF5B7ACD4CA9A01F7006C0A55E
Targets
-
-
Target
b4931c56a04ae78d1676c904e5074ec9e637bad4c0e6184102f97d8ad6e75b7e
-
Size
252KB
-
MD5
676a80221c30288c2bb8a26bfc549b9a
-
SHA1
1a03cadea471f4a5412628b2995c6e988b0c5073
-
SHA256
b4931c56a04ae78d1676c904e5074ec9e637bad4c0e6184102f97d8ad6e75b7e
-
SHA512
d5a0b68bf7702cce1992f7050e4af82ca2be64b0cb5525102fcccbbd14b1aae7ae59a762f368aeb500efc7d193f5507937f1a01f13bed5d3f76664adabf9ab4e
Score10/10-
Modifies boot configuration data using bcdedit
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-