Analysis

  • max time kernel
    87s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-05-2022 21:58

General

  • Target

    bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38.exe

  • Size

    202KB

  • MD5

    7d6fdb848b13baaa910d9526e63e8489

  • SHA1

    61a4735ed7da281859269b727c60dd15285e610a

  • SHA256

    bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38

  • SHA512

    89b48f078831393ea87b4adc9ca31a97d810eefd70d3209691a213718c6b2b08e8e350a9f271752571b21f5d69d1f7b54c35fb8af722d779db782dc3832aeff1

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D

http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D

Extracted

Path

C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about��H�����ϳ�GU��ܛ�Z���I����&v`�>�����k�Ě{/Ɂ5=/��V,��b�Դ ' �[���9��"���Ln��L�+{c�`CVS���&C*Y:��|��z�}�f��_sdh�FX�v���a�Y�S��c�.X�M�X����t~���*�!���zR���z��mC}�i�S��v�;���������r�AC�:��U�s_cWT.��m&Ql� E�l9qy�-rM�aY��FGM�zz��Жf�g�f����b�K���Ne!�w�q��i3n<y���oywjY����K���y���"Kja�G걎��������Y�H��-|q~!�m6���d�g#E��k� ih�l�Q���2� t �x�J �f\)�w_�[�.a��Ǫ�a�)�q!���c�+Y{�j�F��P�r�H�E�����^��Dǥ�;������K�R�����'�Ɩ��蛯Wk{�*�0"��ӬU������ �[E�C���`�HKm����?(�v�+�a�Q:'��HD��:�D�MD�2�����]L� ^��R�K �#O#Yh��O5�U���i3R������Q�l�)�.���s;���6}���K}2ɜ�ҴX�ۮ�:ݽ��YnZ��*#�}���awYf&؆3�5p���)E4{���,`� �;\< ����lI�팚ͥ5lm��Y��5�w�"�«g�muj |�J� � �7���,���������e�T/���[�s�7���A�lL$.���Z�IKֈ��ղ�}F� Y�ġ��9�6BB��p�a[]wZ�uY�Z�/����y�#BN��h���ޑ�V��5�%d�Rk��+���i�ί���R��M���u�+�Q�� V\E%n��&�6�v ��:26�2��s����;�W��r��P� ���IP'�7���8�u�>�dP~麭��k%�f�^�hGt�!��2�%D�f���< n;!2�e�ҩ�y���ok�sl�z���8�YX��CƳC'�T�ShEf���-�w �k�щ���4Ofo��"?I@��3��U�~�?m�m�xq H :a�`������i�>���+!�"���4B8s ��[��+�����s����e3q�� °P V�t�7������_���ԉ�:5 T�("[Z��=}��Q���ȟT�M�&�*X�؄>�$��݌� \Ŀ!4�B(�e3��͸"�����뎂J,_�t�6���:�9�8�)��=Wկvb��۞� 9%���ǰ���=+Z{{X�S�KT��/K���Z��xmx τ=��P�7�S�� �ĂI�@X�l%C�S�$��� l�Z'V���� 5&�<e���:��$yqD��w������Է���� _�cG P�����9��6=� ��R@f�gX�4�O�6U/7���ͳE\��#M�'� �"� ��L3k���;J�C_����4��M��k�4@C�@'fƇB�@��')��$�R�+���Q \�؃�_��`���g�k�!k��!�R��A�?;���p�⒂sA��8RO�;��j�� �0��)�{{ȩ�{j�V�qQF�͛��!f���0��^�Y��8du����u��6�� ?�u U7�;���g�Ó�U���L�aͅr�'��Y�X@�eֿ� ��t���\,P�'�taD���n��٨�A2F�R������������GiM"r����(oO���XŶ�F�;_$n�~��%� ���Ssx��%�����8���!�`��N�$M��X���[���AU/�O�L�d{+_� XR���d���n��2�7�><�=zT��* ���ʢ�n�:�u��� ����e��N���G�����k��[�Z!����[n7�A1v��Ģ�[���.cGH�u�p�u|k��Џ�R`�v G�Y`*�NI>#���q� d���)�~>�7�F�+��. �_ I�6#_k�����g�|��r>�C�ԟg�ڡ�fE�f6���=+�F$�~S���C��/��Ƀ8����B��²�.��ڍL���Y舍�D�/��UQ�Oi���Tn*|�j�S�W,�hW�N"-a�^}�J���|;8a Fi{��̩VF@�y?�v+��� :���5|�&0�|dmq. �FZ�� ��b�T�qm�n�j� zX:媈yD��/@DO���-�Kq���d�(lS��gT8�-��Ͳ*vxY���Ǹ��}՛��(��0V���F��Ȫޗ"�ٔH�'��5�CV9݈�X��Pf�[����z���)����4���dP�Ec 1I�����Y�m�~F��ņ]��t�g����?� �H��� `�=�1�I-��E�Pc��F*_L��;Ugi���s�5p쑉Ң2��ԗN� ^��&Il~���ѫ-��&� ��Ǯ�_��H���׶v5�F�����z��ىw ��M!�#�Dz�M��Q��./��Ǐ\m�Jݮ��~�A�0�P^@ݦ�Ok�F�?�hm�f���h�8y�X�f���(����O�{q'�=a���=<� �H�� ��S�����Y�4*��;�k�yK��2��!N��3Y>�K��@�q"$�-��i5I��P9`�x�t��R�����x����d���9�?i����#.Ͱ+ 8P'G��fU lS!�p �c1��B����8yݔ����W��Қ�X11ނ.Ȝ^ʵ������2�4�$��}�/�NEN�Z�~fr �e �}cAJ�z���%Dͪ�v*V����]��&� ��˃�t����o�m����=� ��-��7������H��f�_��%� ?��� e9��*m����e�DD��tI� ���~�-e3�g|<YH�Yu&eM�p�F���Ey���h��pk^�d�c�ţ�}��,O�ɕK#�ݔcy���@��m�j&�j~�y��x�Í������ѩ�\�l�� T��j�{�@�8�#j��x�[u��׺\)��q[Rn������TKm�_a^H� ���F���%}�'/��m"þ�rc��%�4���1s=z�P�uyD��:Xb��q�"ٵS�l#<����f�,�ZH�Lp�p��n���l���<���]��SE׊��*)�����~"ȋ��"'G� ����4���C5oi��? ��0Y� /����:�����5$20�S�>��}���R0 Á�IH�Ա����}:J�ʒ���B���F����W�l:Œ뒠���,.�,��`rzOC�鱐��T�N��d�oc�(ڨ�^�3Ձ����A�}�H�������XV�G��'�t� �a �0x�q�u�p�t���+^����C���5��a�rP̌�\ǚ�1k����ݔ!FFK�y�_�$�&�xؚ^����#�~ ��� T��N1cXͤ<=�S+�v����x��F埃`�R�C��!��k#^SR�7���P}01�q� ������eq@�0���}�<�S��v����J�E4���< �X�̞�^#�?�=\�+�T-��U���xI�.%��}4Qݎ[IXs�]Uw��U�E��u��Ա��b��VO�y M�z G�����C|頓ŋ��:g�$A���?네݇V��k�Ÿi����"H&����k�#*�ܺ����Tne���ԭ��+�u��v��' �D� ׇ�z���w��"�fJq��A�Tv�%}��#������#*Ewn�Ŭ%���^����u ���g�(�J�(j�c�����Y![�xq�33s~�u��\�,*��C��7��T�N�w��y�m�n���|%�������F����c����L�^������<��3�vn�� ٿ���w���2%���jM98�7.B��߀��,���2+8*Yv�W���B� ��Z(����~M�v��.��K�k�������C�e�{��w��`Sj�=�������|��[˱�h�,��f���|���&l�ې>X䀦�I�D��օ�܍�����V�q�����c�{BTB_ϵ�K�q�Va�o� �09g��O.6^�'{��0�d�-N �������$��F�Et1����X�{�p�������"���Y,�He�Ǧ K\ �rX �9��� Cv���ϴ��! �����^��$��N����“p��?T $�N'���N��Dw"$��*�&*�P��1������P��h �9�����'B߹��s��@o'�0Z�x5a�l��'��������t_4�j
URLs

http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466D

http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466D

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link -http://lockbit-decryptor.com/?ADDD79899D34FB7491C6FF7476CE466DFollow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it.Open link in Tor Browser -http://lockbitks2tvnmwk.onion/?ADDD79899D34FB7491C6FF7476CE466DThis link only works in Tor Browser!Follow the instructions on this pageLockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the siteDo not rename encrypted files.Do not try to decrypt using third party software, it may cause permanent data loss.Decryption of your files with the help of third parties may cause increased price (they add their fee to our).Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN.Tor Browser user manualhttps://tb-manual.torproject.org/about

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Control Panel 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38.exe
    "C:\Users\Admin\AppData\Local\Temp\bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1996
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:992
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1916
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:812
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:1236
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta"
      2⤵
      • Modifies Internet Explorer settings
      PID:2992
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.7 -n 3
        3⤵
        • Runs ping.exe
        PID:3040
      • C:\Windows\SysWOW64\fsutil.exe
        fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\bf30ee00753e7066ca5648d07c32306f0347ad59897d22b3f0a607f14a822f38.exe"
        3⤵
          PID:1940
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1188
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2688
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:2724
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:2752

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Command-Line Interface

        1
        T1059

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        File Deletion

        3
        T1107

        Modify Registry

        3
        T1112

        Discovery

        System Information Discovery

        1
        T1082

        Remote System Discovery

        1
        T1018

        Impact

        Inhibit System Recovery

        4
        T1490

        Defacement

        1
        T1491

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Desktop\LockBit-note.hta
          Filesize

          14KB

          MD5

          806f061502fdd5972ecb72f4b823cf82

          SHA1

          22301dca0ca66378eb35a7218f1b99bb1dcdd65f

          SHA256

          0e5af5b4aa9d85be302cebc526adc9f4aa4066945f3c4310afbd1a348cb12731

          SHA512

          75e2346195756b1c9af2bc04d054fce3170fd0517d11353e48397560106aca0b5beeb4623c6f5a8d19ca372a8ca089db0c5b3a019d854b3ed07eaa4d4044cba8

        • \??\PIPE\srvsvc
          MD5

          d41d8cd98f00b204e9800998ecf8427e

          SHA1

          da39a3ee5e6b4b0d3255bfef95601890afd80709

          SHA256

          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

          SHA512

          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        • memory/812-62-0x0000000000000000-mapping.dmp
        • memory/992-60-0x0000000000000000-mapping.dmp
        • memory/1236-64-0x000007FEFBF01000-0x000007FEFBF03000-memory.dmp
          Filesize

          8KB

        • memory/1236-63-0x0000000000000000-mapping.dmp
        • memory/1288-58-0x0000000000000000-mapping.dmp
        • memory/1580-54-0x0000000076811000-0x0000000076813000-memory.dmp
          Filesize

          8KB

        • memory/1580-57-0x0000000000400000-0x0000000000C63000-memory.dmp
          Filesize

          8.4MB

        • memory/1580-56-0x0000000000220000-0x0000000000246000-memory.dmp
          Filesize

          152KB

        • memory/1580-55-0x0000000000DCB000-0x0000000000DE2000-memory.dmp
          Filesize

          92KB

        • memory/1916-61-0x0000000000000000-mapping.dmp
        • memory/1940-71-0x0000000000000000-mapping.dmp
        • memory/1996-59-0x0000000000000000-mapping.dmp
        • memory/2992-66-0x0000000000000000-mapping.dmp
        • memory/3008-67-0x0000000000000000-mapping.dmp
        • memory/3040-68-0x0000000000000000-mapping.dmp