General

  • Target

    bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38

  • Size

    202KB

  • Sample

    220524-1vrceahdd8

  • MD5

    7d6fdb848b13baaa910d9526e63e8489

  • SHA1

    61a4735ed7da281859269b727c60dd15285e610a

  • SHA256

    bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38

  • SHA512

    89b48f078831393ea87b4adc9ca31a97d810eefd70d3209691a213718c6b2b08e8e350a9f271752571b21f5d69d1f7b54c35fb8af722d779db782dc3832aeff1

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D

http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D

Extracted

Path

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about��H�����ϳ�GU��ܛ�Z���I����&v`�>�����k�Ě{/Ɂ5=/��V,��b�Դ ' �[���9��"���Ln��L�+{c�`CVS���&C*Y:��|��z�}�f��_sdh�FX�v���a�Y�S��c�.X�M�X����t~���*�!���zR���z��mC}�i�S��v�;���������r�AC�:��U�s_cWT.��m&Ql� E�l9qy�-rM�aY��FGM�zz��Жf�g�f����b�K���Ne!�w�q��i3n<y���oywjY����K���y���"Kja�G걎��������Y�H��-|q~!�m6���d�g#E��k� ih�l�Q���2� t �x�J �f\)�w_�[�.a��Ǫ�a�)�q!���c�+Y{�j�F��P�r�H�E�����^��Dǥ�;������K�R�����'�Ɩ��蛯Wk{�*�0"��ӬU������ �[E�C���`�HKm����?(�v�+�a�Q:'��HD��:�D�MD�2�����]L� ^��R�K �#O#Yh��O5�U���i3R������Q�l�)�.���s;���6}���K}2ɜ�ҴX�ۮ�:ݽ��YnZ��*#�}���awYf&؆3�5p���)E4{���,`� �;\< ����lI�팚ͥ5lm��Y��5�w�"�«g�muj |�J� � �7���,���������e�T/���[�s�7���A�lL$.���Z�IKֈ��ղ�}F� Y�ġ��9�6BB��p�a[]wZ�uY�Z�/����y�#BN��h���ޑ�V��5�%d�Rk��+���i�ί���R��M���u�+�Q�� V\E%n��&�6�v ��:26�2��s����;�W��r��P� ���IP'�7���8�u�>�dP~麭��k%�f�^�hGt�!��2�%D�f���< n;!2�e�ҩ�y���ok�sl�z���8�YX��CƳC'�T�ShEf���-�w �k�щ���4Ofo��"?I@��3��U�~�?m�m�xq H :a�`������i�>���+!�"���4B8s ��[��+�����s����e3q�� °P V�t�7������_���ԉ�:5 T�("[Z��=}��Q���ȟT�M�&�*X�؄>�$��݌� \Ŀ!4�B(�e3��͸"�����뎂J,_�t�6���:�9�8�)��=Wկvb��۞� 9%���ǰ���=+Z{{X�S�KT��/K���Z��xmx τ=��P�7�S�� �ĂI�@X�l%C�S�$��� l�Z'V���� 5&�<e���:��$yqD��w������Է���� _�cG P�����9��6=� ��R@f�gX�4�O�6U/7���ͳE\��#M�'� �"� ��L3k���;J�C_����4��M��k�4@C�@'fƇB�@��')��$�R�+���Q \�؃�_��`���g�k�!k��!�R��A�?;���p�⒂sA��8RO�;��j�� �0��)�{{ȩ�{j�V�qQF�͛��!f���0��^�Y��8du����u��6�� ?�u U7�;���g�Ó�U���L�aͅr�'��Y�X@�eֿ� ��t���\,P�'�taD���n��٨�A2F�R������������GiM"r����(oO���XŶ�F�;_$n�~��%� ���Ssx��%�����8���!�`��N�$M��X���[���AU/�O�L�d{+_� XR���d���n��2�7�><�=zT��* ���ʢ�n�:�u��� ����e��N���G�����k��[�Z!����[n7�A1v��Ģ�[���.cGH�u�p�u|k��Џ�R`�v G�Y`*�NI>#���q� d���)�~>�7�F�+��. �_ I�6#_k�����g�|��r>�C�ԟg�ڡ�fE�f6���=+�F$�~S���C��/��Ƀ8����B��²�.��ڍL���Y舍�D�/��UQ�Oi���Tn*|�j�S�W,�hW�N"-a�^}�J���|;8a Fi{��̩VF@�y?�v+��� :���5|�&0�|dmq. �FZ�� ��b�T�qm�n�j� zX:媈yD��/@DO���-�Kq���d�(lS��gT8�-��Ͳ*vxY���Ǹ��}՛��(��0V���F��Ȫޗ"�ٔH�'��5�CV9݈�X��Pf�[����z���)����4���dP�Ec 1I�����Y�m�~F��ņ]��t�g����?� �H��� `�=�1�I-��E�Pc��F*_L��;Ugi���s�5p쑉Ң2��ԗN� ^��&Il~���ѫ-��&� ��Ǯ�_��H���׶v5�F�����z��ىw ��M!�#�Dz�M��Q��./��Ǐ\m�Jݮ��~�A�0�P^@ݦ�Ok�F�?�hm�f���h�8y�X�f���(����O�{q'�=a���=<� �H�� ��S�����Y�4*��;�k�yK��2��!N��3Y>�K��@�q"$�-��i5I��P9`�x�t��R�����x����d���9�?i����#.Ͱ+ 8P'G��fU lS!�p �c1��B����8yݔ����W��Қ�X11ނ.Ȝ^ʵ������2�4�$��}�/�NEN�Z�~fr �e �}cAJ�z���%Dͪ�v*V����]��&� ��˃�t����o�m����=� ��-��7������H��f�_��%� ?��� e9��*m����e�DD��tI� ���~�-e3�g|<YH�Yu&eM�p�F���Ey���h��pk^�d�c�ţ�}��,O�ɕK#�ݔcy���@��m�j&�j~�y��x�Í������ѩ�\�l�� T��j�{�@�8�#j��x�[u��׺\)��q[Rn������TKm�_a^H� ���F���%}�'/��m"þ�rc��%�4���1s=z�P�uyD��:Xb��q�"ٵS�l#<����f�,�ZH�Lp�p��n���l���<���]��SE׊��*)�����~"ȋ��"'G� ����4���C5oi��? ��0Y� /����:�����5$20�S�>��}���R0 Á�IH�Ա����}:J�ʒ���B���F����W�l:Œ뒠���,.�,��`rzOC�鱐��T�N��d�oc�(ڨ�^�3Ձ����A�}�H�������XV�G��'�t� �a �0x�q�u�p�t���+^����C���5��a�rP̌�\ǚ�1k����ݔ!FFK�y�_�$�&�xؚ^����#�~ ��� T��N1cXͤ<=�S+�v����x��F埃`�R�C��!��k#^SR�7���P}01�q� ������eq@�0���}�<�S��v����J�E4���< �X�̞�^#�?�=\�+�T-��U���xI�.%��}4Qݎ[IXs�]Uw��U�E��u��Ա��b��VO�y M�z G�����C|頓ŋ��:g�$A���?네݇V��k�Ÿi����"H&����k�#*�ܺ����Tne���ԭ��+�u��v��' �D� ׇ�z���w��"�fJq��A�Tv�%}��#������#*Ewn�Ŭ%���^����u ���g�(�J�(j�c�����Y![�xq�33s~�u��\�,*��C��7��T�N�w��y�m�n���|%�������F����c����L�^������<��3�vn�� ٿ���w���2%���jM98�7.B��߀��,���2+8*Yv�W���B� ��Z(����~M�v��.��K�k�������C�e�{��w��`Sj�=�������|��[˱�h�,��f���|���&l�ې>X䀦�I�D��օ�܍�����V�q�����c�{BTB_ϵ�K�q�Va�o� �09g��O.6^�'{��0�d�-N �������$��F�Et1����X�{�p�������"���Y,�He�Ǧ K\ �rX �9��� Cv���ϴ��! �����^��$��N����“p��?T $�N'���N��Dw"$��*�&*�P��1������P��h �9�����'B߹��s��@o'�0Z�x5a�l��'��������t_4�j
URLs

http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D

http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link -http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466DFollow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it.Open link in Tor Browser -http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466DThis link only works in Tor Browser!Follow the instructions on this pageLockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the siteDo not rename encrypted files.Do not try to decrypt using third party software, it may cause permanent data loss.Decryption of your files with the help of third parties may cause increased price (they add their fee to our).Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN.Tor Browser user manualhttps://tb-manual.torproject.org/about

Extracted

Path

C:\odt\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.com/?ADDD79899D34FB74C43F52B0A95DA6A7 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?ADDD79899D34FB74C43F52B0A95DA6A7 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.com/?ADDD79899D34FB74C43F52B0A95DA6A7

http://lockbitks2tvnmwk.onion/?ADDD79899D34FB74C43F52B0A95DA6A7

Targets

    • Target

      bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38

    • Size

      202KB

    • MD5

      7d6fdb848b13baaa910d9526e63e8489

    • SHA1

      61a4735ed7da281859269b727c60dd15285e610a

    • SHA256

      bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38

    • SHA512

      89b48f078831393ea87b4adc9ca31a97d810eefd70d3209691a213718c6b2b08e8e350a9f271752571b21f5d69d1f7b54c35fb8af722d779db782dc3832aeff1

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

3
T1107

Modify Registry

3
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Impact

Inhibit System Recovery

4
T1490

Defacement

1
T1491

Tasks