Overview

overview

10

Static

static

d742fc3fe5...d5.exe

windows10-2004-x64

10

Resubmissions

11-10-2022 06:39

221011-henx8sadg7 10

11-10-2022 06:31

221011-haj4gsaebn 10

Analysis

  • max time kernel
    207s
  • max time network
    284s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2022 06:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe

  • Size

    1.8MB

  • MD5

    069170f61d9638c87dab750877065a4a

  • SHA1

    21b592ca0ce2e353640893b039eb84dfc7d55d14

  • SHA256

    d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5

  • SHA512

    bb9c4965c5b67b2f1c6190de6daad373bc4cdc7b4c596d50547408447ba9553904ec4e9c49038ef2ffafc80dffcd43462a67d7097ed4bdcce60356da6e73d218

  • SSDEEP

    24576:EnA1KgRYWHEvtd8LHhFJpxjMnA1KgRYWHEvtd8LHhFJpxjJ:D1K5ve1K5v

Score
10/10
lockfilepersistenceransomware

Malware Config

Signatures

  • LockFile

    LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.

    ransomwarelockfile
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe
    "C:\Users\Admin\AppData\Local\Temp\d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    PID:4604
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5028
  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\6d4c13e03e064d3da7eb40715d8c9ea9 /t 2616 /p 2592
    1⤵
      PID:3636
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2780
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:4380
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3536
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3328

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      2
      T1112

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      Peripheral Device Discovery

      2
      T1120

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt
        Filesize

        630B

        MD5

        97d61dd38158163712ff1f93b02185dc

        SHA1

        aeeff9e4e9c82b7093cb222e038c1a6fcfcf06a3

        SHA256

        87c7671f844922e5d75372ff60271462c1f19105dce05c36a49bcbb6f93284d9

        SHA512

        23b9a3da5c54e3528e79ef2529619e9a3828eb049baa59a0f67c6102179f134fcde03f30d8d36b2078e89fd6a28fc107a9c03814cd0ceb32e70495f36eb1655d

        Download Submit
      • memory/3328-146-0x000001A7D9F30000-0x000001A7D9F38000-memory.dmp
        Filesize

        32KB

        Download
      • memory/3328-147-0x000001A7D9E00000-0x000001A7D9E20000-memory.dmp
        Filesize

        128KB

        Download