Overview

overview

10

Static

static

5e79854b8a...63.exe

windows7-x64

7

5e79854b8a...63.exe

windows10-2004-x64

10

f6fbfa9fe3...b4.exe

windows7-x64

7

f6fbfa9fe3...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 09:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4.exe

  • Size

    1.5MB

  • MD5

    48aa442a0670b65a82eee99c1ed1ac78

  • SHA1

    12117609b746257a6cdd2808dcb50c6af9c1810d

  • SHA256

    f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4

  • SHA512

    f76db6e03154e7221f26b3329c434f00d775f99411ee9ec258652a0a7f52c90e0de9794d6754b5910cf169776ae87abf982cd778eb6f06b69fe5a11135e26e5c

  • SSDEEP

    24576:9bas1P80H8OziJNLCubRnkkBqKU3QMNrm1gPB7MjsjfoxKHHU4tsQkdZ:VlH8ucW9jhmyPBYjSzHHU4tshdZ

Score
10/10
lockbitdiscoveryevasionpersistenceransomware

Malware Config

Extracted

Path

C:\odt\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 2DCCD853D3686BAE3B347E0835875EDB
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4.exe
    "C:\Users\Admin\AppData\Local\Temp\f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4.exe
      ﮅ
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1468
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:3080
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2536
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4244
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 928
      2⤵
      • Program crash
      PID:1480
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2916 -ip 2916
    1⤵
      PID:3360
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2920

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Network Service Scanning

    1
    T1046

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    3
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsf63D0.tmp\System.dll
      Filesize

      12KB

      MD5

      cff85c549d536f651d4fb8387f1976f2

      SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

      SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

      SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

      Download Submit
    • memory/1468-139-0x0000000000000000-mapping.dmp
      Download
    • memory/2244-133-0x0000000000000000-mapping.dmp
      Download
    • memory/2244-134-0x0000000000401000-0x00000000004E1000-memory.dmp
      Filesize

      896KB

      Download
    • memory/2244-135-0x00000000004FA000-0x00000000004FB000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2244-136-0x00000000004FA000-0x00000000004FB000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2244-137-0x0000000000400000-0x00000000004FB000-memory.dmp
      Filesize

      1004KB

      Download
    • memory/2244-138-0x0000000000400000-0x00000000004FB000-memory.dmp
      Filesize

      1004KB

      Download
    • memory/2536-141-0x0000000000000000-mapping.dmp
      Download
    • memory/3080-140-0x0000000000000000-mapping.dmp
      Download
    • memory/3772-143-0x0000000000000000-mapping.dmp
      Download
    • memory/4244-142-0x0000000000000000-mapping.dmp
      Download