Analysis
-
max time kernel
136s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
24-08-2022 19:26
General
-
Target
b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893.exe
-
Size
81KB
-
MD5
3ee21dbaa37d0048e2e174cb41a664d6
-
SHA1
f7799dc7530c3234dd2d5c11b74361b7ec1daefb
-
SHA256
b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893
-
SHA512
7cfcc286522cc1d70f4f0d83e8a6e9ed27a7b94ead3f272a271ce1bf6708c91b0f19ddbf7cdebe44239c903142bd8f9b1949d17cbce0dd39e9491acb9744e947
-
SSDEEP
1536:+uBQrT1eLBBdU/1GJj4UgvpedwwtVNUmrTF3MqqU+hV2xQie:+uBUwX0C4Vvs2wT+mr5MqqD/Fi
Score
10/10
Malware Config
Extracted
Path
C:\Restore-My-Files.txt
Family
lockbit
Ransom Note
All your important files are encrypted!
There is only one way to get your files back:
1. Contact with us
2. Send us 1 any encrypted your file and your personal key
3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files
4. Pay
5. We send for you decryptor software
We accept Bitcoin
Attention!
Do not rename encrypted files.
Do not try to decrypt using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price(they add their fee to our)
Contact information: [email protected]
Be sure to duplicate your message on the e-mail: [email protected]
Your personal id:
�Ce3YhOSP5hi9+rvHRQsPtxQLRUGct4JkOcveF1oDOdLSITpa5PGT3Vjdwg4Pvy9q
OH2BC4us0FOnh+DFu5R1R52r0OEHXmGZcVpwd2UJdyknB0yYi+jq/qC9q3LZrd14
9PEq6VG9DYEYaUABGXXFgS5fWCT+MP5dZF8rLwx3TVLg0EgMJFd7IlM3Hqz53boc
Zb++f9/b1Blgd/3kwfTYflfpWuZ9wFGVGMlSz+FsArQzfdfrN7uSjniTjW3ttKFD
LU6QcKVTo9OLlWMc+ZQNojZjUgz11tXWlIhc9xU/QMuo8FLKf/9MrSMaCFngWKjR
6tsttlhHHzeMouNDCoY0QoTbDjxVrle1+U73RGu50sqs7ea26+UGsqG2++ABXlwQ
ocrFC9O9p6zTs3d2PKaxsIhfR/UIs8Ap7+AhjzK8lnxVcIhb3Snx8lDDN+EJQOJ7
Ts9hiLhhsif8gyyBsaBlctC+JT6HVsJ06SW4GGutz6UPtBp5n9Dr7XW/dmdNXFYR
heO/SlZw6rg/NlPXO7fYPys7js1rk4SSivWXb86OFzzR/wXYH6QVm7h9ZnPAZT9Y
RmhZMn1RFPVVAQ45NSaJantEn6X+oA3hDwnW8OXbRL6qnAP48MsjHizJC8iWtzvu
QK88YnRKrilFe+yf67IgtzCfLx04TGlglR88myy7WuANedt0odh9yFhKt0FCEWru
dO2sQlfLAcyu9fXSLdS1I6eH8K33bMKK/EmoRlK7WYsq5U3VDV28hOa7X+tivkxy
NJdBbMbgR1eB+xsCHfUYTnPZvXW1fqJIR4VD6/fUjFmynPXltlYlVDCIdqr5jZeR
RH8QtWLx+9fh5Q66cCI0MZqeyfFtA3AfjN/MoV8zK+OCI3LPbFImcgB/JhKCJ51v
+KOHZO/8Lk0qElOvXD2t/MFJYzBK/x1GqrSg06z5Er8mOLzZQvUyYXrLmpNBmvMy
wHAPLLw7jevdSofk04i8DzPD2VVsD7OxZIMPzTggJRbsNurACJaGLb1IR56Krq3m
GAAUd9dlTNA/QBz9Kyk6eTU84bw7NlGfIoAt5PpRWw0SMQ3ZZqdmDIXXZwn4Pq9D
uVrZchX2aELQSQ7Wf19qV+7CXwxbv3Fp3SuqJfIc0ssIat/MeH2kQP7mxZmONSps
7vEZIp5jRihICyBfx05VbM3sebY4CIrLUNRXW+kYFXZUTZRkJN7uJ0BdWekejuQH
DDfGHvv56NhkAxRAmA8eeBPWjsMzj6ujyw2NbQV8fIicR3YB9UsZqo7XqARgM1K9
46iesR7CAcHGkGdteDi59i193Nz7WfN4zz36vIOPPjjlecxz0JbcM4iubbkjkOqI
Phy+fRaRWkybY4jUS3TIfQ+pDZrgvUgIjVKvw+k6o4VSL0DXuKmQOeiYJb5flp8N
Sd5gK9p+qGJ1GJsgnrKxYGn1SfHyIy+GkgrnrocLkIdbScJDHyJKYU0NO3ndzuj3
V8pqUhwgpnut5iaLAamI5kAXtE86m4Br9A0UuU77b/X7zbmJq0H6tzwdMQAQf7Xw
XMhKJAjsT7o/nwIqHR/LgzwkQNoAG4o9P4kf2oPIZpYB2jNftxJV4ZzOO6qEG5jT
/7BU4KgZPcBEqM+fvONuyapNjpQFi2s3wqY5B2TRFwX5BbNt/iiddn/bYByIk41s
WlCaBVsFzcpIrI0yedHM6wW+jLEIFNvO2oXjStYb9Oo=
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs
-
Deletes System State backups 3 TTPs 6 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893.exe"C:\Users\Admin\AppData\Local\Temp\b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 20 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 203⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)