Analysis
-
max time kernel
301s -
max time network
315s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 18:07
Static task
static1
Behavioral task
behavioral1
Sample
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe
Resource
win10v2004-20221111-en
General
-
Target
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe
-
Size
1.0MB
-
MD5
3bec3b0adf1e8e1e1ccc8dc6751c16b0
-
SHA1
92adb33367fd4192ce80cc0a734416b29742d050
-
SHA256
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1
-
SHA512
d17cf5d2fcc7b7a7ee3a1aaa9f287caa4703690f4e7089db3022524a3aa7cf589d4f63a62a89f4f8ae1e2cce3a5f043bd82df8c960d545a719abb71097bd3fef
-
SSDEEP
12288:uAAligk8G2carFVcVKcovYGm4+UDQcZiRU0W7AGpnYgzQsAFv0XVE7gPsZpGnnvO:ulKvwrkKc2/IUB7A8AFv0X27HZkv8
Malware Config
Extracted
C:\Users\Admin\Desktop\HELP.TXT
http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion
http://lorenzedzgezlufsyu26s5onxjjakikbpbwo7km6upptlxp5m3ytftad.onion.ly
http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion
https://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion.ly
Signatures
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exedescription ioc process File created C:\Users\Admin\Pictures\ConfirmAssert.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Users\Admin\Pictures\DisconnectCopy.tiff.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Users\Admin\Pictures\WriteUnlock.raw.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exedescription ioc process File opened (read-only) \??\B: 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File opened (read-only) \??\A: 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\PackageManagementDscUtilities.strings.psd1.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ja-jp\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main.css.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\virgo-new-folder.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\s_thumbnailview_18.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-focus_32.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\editpdf.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\svgCheckboxSelected.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster2x.jpg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ro_get.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.Tests.ps1.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_ie8.gif.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.strings.psd1.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_shared_multi_filetype.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.Tests.ps1.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.strings.psd1.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ro-ro\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-hover_32.svg.Lorenz.sz40 804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe"C:\Users\Admin\AppData\Local\Temp\804cc598b3b5f0c4e11a184a2f5da4b668ad1557eee972894e99aef781fff7a1.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory