Overview

overview

10

Static

static

locker.exe

windows7-x64

10

locker.exe

windows10-2004-x64

10

Resubmissions

29-09-2022 00:29

220929-as31bahde7 10

25-09-2022 15:03

220925-se2t7sgdap 10

Analysis

  • max time kernel
    108s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2022 15:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    locker.exe

  • Size

    178KB

  • MD5

    8d27d0c897ce21f1036bf659fc663cf2

  • SHA1

    afe3d0fb48092aeca4dcd3989a076e87fdbe69b2

  • SHA256

    139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1

  • SHA512

    531873e8faaf801a447f70848969865750f41fd5ff15bd8c47015e766a9bb8cc1fbb8dcae16ddbf1e4f9dbc5750af593ef8fdcf94cd1a61efa00c7790cda4374

  • SSDEEP

    3072:/gq2DKdMbv1S/n6rHBJK3V9LBSLrKa+HQXvMES/D3Yw7yZyYpEaI:/84X/19LUPMcMEw3kTI

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\warning !!!! Readme bl00dy Gang.txt

Ransom Note
GREETINGS FROM BL00DY RANSOMWARE GANG What happened ? Your entire company network is penetrated and encrypted. All files on servers and computers locked and not usable Dont panic All files are decryptable We will recover all your files to normal What Bl00dy Gang take / steal from your company network ? We download your company important files / documents / databases/ mails / accounts We publish it to the public if you dont cooperate . What BL00DY Gang needs from YOU ? We expect nothing except appreciating our work PAY US in this way you appreciate our work How to contact the BL00DY Gang for ransom negotiations ? filedecryptionsupport@msgsafe.io Telegram hall of shame , where all company private data will be PUBLISHED?? https://t.me/bl00dy_Ransomware_Gang What Quarantees ? we are not a politically motivated group and we do not need anything other than your money. If you pay, we provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We will help protect your company from any other attacks ; we will give you tips to secure company network We always keep our promises. !!! BEWARE !!! If you have Backups and try to restore from backups . All entire company files / databases / everything will be posted online DON'T try to rename or modify encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! - Don't try because you will damage all the files Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Do not report to Police or FBI , they dont care about your business .They will tell you not to pay and you will lose all your files. Recovery Company Cannot help You . things will get rather worse . speak for yourself.
Emails

filedecryptionsupport@msgsafe.io

URLs

https://t.me/bl00dy_Ransomware_Gang

Signatures

  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 46 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\locker.exe
    "C:\Users\Admin\AppData\Local\Temp\locker.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{309BDB4B-09FA-4B2E-A35D-461EB97EED0F}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{309BDB4B-09FA-4B2E-A35D-461EB97EED0F}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1712
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{29A0A02F-1E9E-4A50-93C4-1D938C11D8A3}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{29A0A02F-1E9E-4A50-93C4-1D938C11D8A3}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1768
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{63518277-314E-424C-927F-BE5311012F87}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{63518277-314E-424C-927F-BE5311012F87}'" delete
        3⤵
          PID:1204
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE926DAD-1617-4795-B527-6BF393D8C84F}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1940
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE926DAD-1617-4795-B527-6BF393D8C84F}'" delete
          3⤵
            PID:1528
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA815155-F367-44DF-81BC-9261FA314804}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA815155-F367-44DF-81BC-9261FA314804}'" delete
            3⤵
              PID:1808
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40CED04A-6E3E-4F2B-A898-3A91BC30C720}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:996
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40CED04A-6E3E-4F2B-A898-3A91BC30C720}'" delete
              3⤵
                PID:1056
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84A94E09-FA64-4706-922F-1A42644841C7}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:592
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84A94E09-FA64-4706-922F-1A42644841C7}'" delete
                3⤵
                  PID:1996
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5310782C-4B83-44EF-A20A-4EF0D7F0F1CB}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1456
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5310782C-4B83-44EF-A20A-4EF0D7F0F1CB}'" delete
                  3⤵
                    PID:1776
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C1F9BEBD-4E70-454E-8D24-DD4AE488E0DD}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1712
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C1F9BEBD-4E70-454E-8D24-DD4AE488E0DD}'" delete
                    3⤵
                      PID:844
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5511917A-F208-4E79-AEC9-AE6599F02876}'" delete
                    2⤵
                      PID:1768
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5511917A-F208-4E79-AEC9-AE6599F02876}'" delete
                        3⤵
                          PID:1352
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4B689505-5AE8-4A90-B1F2-497F7F0C4150}'" delete
                        2⤵
                          PID:1204
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4B689505-5AE8-4A90-B1F2-497F7F0C4150}'" delete
                            3⤵
                              PID:1844
                          • C:\Windows\system32\cmd.exe
                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B3B653C1-A05E-459A-BD91-502AA66C0CEE}'" delete
                            2⤵
                              PID:1328
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B3B653C1-A05E-459A-BD91-502AA66C0CEE}'" delete
                                3⤵
                                  PID:808
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1E48722-B271-4CCD-AEF4-7F12F6FADC6A}'" delete
                                2⤵
                                  PID:1260
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1E48722-B271-4CCD-AEF4-7F12F6FADC6A}'" delete
                                    3⤵
                                      PID:1684
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F9276E2F-ACFF-4708-BCB1-F0A9011CD438}'" delete
                                    2⤵
                                      PID:1380
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F9276E2F-ACFF-4708-BCB1-F0A9011CD438}'" delete
                                        3⤵
                                          PID:1172
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A3C8AB8E-8532-4D1E-9214-4210D792EC6A}'" delete
                                        2⤵
                                          PID:1992
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A3C8AB8E-8532-4D1E-9214-4210D792EC6A}'" delete
                                            3⤵
                                              PID:972
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E76C29A-2DC1-410F-80E4-1E8FD3F45D65}'" delete
                                            2⤵
                                              PID:1760
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E76C29A-2DC1-410F-80E4-1E8FD3F45D65}'" delete
                                                3⤵
                                                  PID:1456
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5B20EEB1-2BE5-498F-A1E2-70CDF5EC36A8}'" delete
                                                2⤵
                                                  PID:968
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5B20EEB1-2BE5-498F-A1E2-70CDF5EC36A8}'" delete
                                                    3⤵
                                                      PID:1712
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{473003D3-A154-4F7C-9D8C-00BACFEAC351}'" delete
                                                    2⤵
                                                      PID:1444
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{473003D3-A154-4F7C-9D8C-00BACFEAC351}'" delete
                                                        3⤵
                                                          PID:1660
                                                    • C:\Windows\system32\vssvc.exe
                                                      C:\Windows\system32\vssvc.exe
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2040

                                                    Network

                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Privilege Escalation

                                                    Defense Evasion

                                                    Credential Access

                                                    Credentials in Files

                                                    1
                                                    T1081

                                                    Discovery

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Exfiltration

                                                    Command and Control

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • memory/592-67-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/736-54-0x0000000076201000-0x0000000076203000-memory.dmp
                                                      Filesize

                                                      8KB

                                                      Download
                                                    • memory/808-78-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/844-72-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/968-87-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/972-84-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/996-65-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1056-66-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1172-82-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1204-60-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1204-75-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1260-79-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1328-77-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1332-59-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1352-74-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1380-81-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1444-89-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1456-69-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1456-86-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1528-62-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1656-55-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1660-90-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1684-80-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1704-57-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1712-71-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1712-88-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1712-56-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1760-85-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1768-58-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1768-73-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1776-70-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1808-64-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1828-63-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1844-76-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1940-61-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1992-83-0x0000000000000000-mapping.dmp
                                                      Download
                                                    • memory/1996-68-0x0000000000000000-mapping.dmp
                                                      Download