lockbit | c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f

General

Target

6150.exe
Size

959KB
MD5

df7a9a45a10c1942225eb9be257fb752
SHA1

874630d6f4bdf9224125d35f30c48bc6d1da8ec1
SHA256

c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f
SHA512

c812b5bfbba51b196954e0c14668e3b46b79db3c62848a8be4f96ef12105948e22e41949c5a62e661ddda0126900d5058cf641b3351fa4b0ce0a3e7fd2aecbe2
SSDEEP

24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdsF:Ujrc2So1Ff+B3k796e

Score

10^/10

lockbit discovery evasion persistence ransomware

Malware Config

Extracted

Path

C:\program files\7-zip\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: F189D874E328CF93121BC86660AA1348

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3348 bcdedit.exe
1632 bcdedit.exe

pid	process
3348	bcdedit.exe
1632	bcdedit.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

6150.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SkipRead.tif => C:\users\admin\pictures\skipread.tif.lockbit	6150.exe
File renamed	C:\Users\Admin\Pictures\LockUse.raw => C:\users\admin\pictures\lockuse.raw.lockbit	6150.exe
File renamed	C:\Users\Admin\Pictures\ExportWatch.png => C:\users\admin\pictures\exportwatch.png.lockbit	6150.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6150.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E7894974-2828-CFE0-79A7-7920B9D0E148} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6150.exe\""	6150.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	6150.exe

Drops file in System32 directory 1 IoCs

Processes:

6150.exe

description ioc process

File created C:\windows\SysWOW64\F189D8.ico 6150.exe

description	ioc	process
File created	C:\windows\SysWOW64\F189D8.ico	6150.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs

Processes:

6150.exe

pid	process
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe
900	6150.exe

Drops file in Program Files directory 64 IoCs

Processes:

6150.exe

description	ioc	process
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar	6150.exe
File opened for modification	C:\program files\microsoft games\more games\en-us\moregames.dll.mui	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir4b.gif	6150.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\ja-jp\picturepuzzle.html	6150.exe
File opened for modification	C:\program files\7-zip\lang\af.txt	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\config\modules\org-netbeans-core-execution.xml_hidden	6150.exe
File opened for modification	C:\program files\microsoft games\multiplayer\backgammon\ja-jp\bckgres.dll.mui	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\media\cagcat10\j0205466.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\submit.js	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\save.gif	6150.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\ja-jp\gadget.xml	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\systemv\pst8	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0250997.wmf	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_cn.jar	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\rssfeeds.gadget\images\item_hover_flyout.png	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\weather.gadget\images\8.png	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\wb01238_.gif	6150.exe
File created	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\Restore-My-Files.txt	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\pssketlg.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\mscol11.ppd	6150.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\clock.gadget\de-de\gadget.xml	6150.exe
File opened for modification	C:\program files\dvd maker\shared\dvdstyles\pets\notes_intro_bg_pal.wmv	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\slideshow.gadget\es-es\settings.html	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\hh01461_.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\media\cagcat10\j0315447.jpg	6150.exe
File opened for modification	C:\program files\java\jre7\lib\zi\america\fortaleza	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\weather.gadget\de-de\settings.html	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\1033\grooveforms5\bg_premium.gif	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsviewframe.html	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\pubwiz\prog98.poc	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\hh00623_.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\wb01734_.gif	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\media\cagcat10\j0221903.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\so00222_.wmf	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\clock.gadget\images\flower_s.png	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\settings_box_top.png	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\so00913_.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck.css	6150.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\clock.gadget\images\system_settings.png	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\etc\gmt+3	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\clock.gadget\images\settings_box_divider_left.png	6150.exe
File opened for modification	C:\program files\windows sidebar\gadgets\currency.gadget\ja-jp\js\currency.js	6150.exe
File opened for modification	C:\program files (x86)\adobe\reader 9.0\reader\tracker\reviewers.gif	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\arrow.png	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir49b.gif	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\templates\1033\access\wss\107.accdt	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\media\cagcat10\j0186348.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\viewheaderpreview.jpg	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_cn.jar	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0102594.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\so02437_.wmf	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\queries\msn moneycentral investor stock quotes.iqy	6150.exe
File opened for modification	C:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.zip	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\asia\urumqi	6150.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar	6150.exe
File opened for modification	C:\program files\7-zip\lang\ku-ckb.txt	6150.exe
File opened for modification	C:\program files\videolan\vlc\skins\default.vlt	6150.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0099175.wmf	6150.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2144 vssadmin.exe

pid	process
2144	vssadmin.exe

Modifies registry class 3 IoCs

Processes:

6150.exe

description	ioc	process
Key created	\Registry\Machine\Software\Classes\.lockbit	6150.exe
Key created	\Registry\Machine\Software\Classes\.lockbit\DefaultIcon	6150.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F189D8.ico"	6150.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

6150.exe

pid process

900 6150.exe
900 6150.exe
900 6150.exe
900 6150.exe
900 6150.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

6150.exevssvc.exeWMIC.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	900	6150.exe
Token: SeDebugPrivilege	900	6150.exe
Token: SeBackupPrivilege	2364	vssvc.exe
Token: SeRestorePrivilege	2364	vssvc.exe
Token: SeAuditPrivilege	2364	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2064	WMIC.exe
Token: SeSecurityPrivilege	2064	WMIC.exe
Token: SeTakeOwnershipPrivilege	2064	WMIC.exe
Token: SeLoadDriverPrivilege	2064	WMIC.exe
Token: SeSystemProfilePrivilege	2064	WMIC.exe
Token: SeSystemtimePrivilege	2064	WMIC.exe
Token: SeProfSingleProcessPrivilege	2064	WMIC.exe
Token: SeIncBasePriorityPrivilege	2064	WMIC.exe
Token: SeCreatePagefilePrivilege	2064	WMIC.exe
Token: SeBackupPrivilege	2064	WMIC.exe
Token: SeRestorePrivilege	2064	WMIC.exe
Token: SeShutdownPrivilege	2064	WMIC.exe
Token: SeDebugPrivilege	2064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2064	WMIC.exe
Token: SeRemoteShutdownPrivilege	2064	WMIC.exe
Token: SeUndockPrivilege	2064	WMIC.exe
Token: SeManageVolumePrivilege	2064	WMIC.exe
Token: 33	2064	WMIC.exe
Token: 34	2064	WMIC.exe
Token: 35	2064	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2064	WMIC.exe
Token: SeSecurityPrivilege	2064	WMIC.exe
Token: SeTakeOwnershipPrivilege	2064	WMIC.exe
Token: SeLoadDriverPrivilege	2064	WMIC.exe
Token: SeSystemProfilePrivilege	2064	WMIC.exe
Token: SeSystemtimePrivilege	2064	WMIC.exe
Token: SeProfSingleProcessPrivilege	2064	WMIC.exe
Token: SeIncBasePriorityPrivilege	2064	WMIC.exe
Token: SeCreatePagefilePrivilege	2064	WMIC.exe
Token: SeBackupPrivilege	2064	WMIC.exe
Token: SeRestorePrivilege	2064	WMIC.exe
Token: SeShutdownPrivilege	2064	WMIC.exe
Token: SeDebugPrivilege	2064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2064	WMIC.exe
Token: SeRemoteShutdownPrivilege	2064	WMIC.exe
Token: SeUndockPrivilege	2064	WMIC.exe
Token: SeManageVolumePrivilege	2064	WMIC.exe
Token: 33	2064	WMIC.exe
Token: 34	2064	WMIC.exe
Token: 35	2064	WMIC.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

6150.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1716	900	6150.exe	cmd.exe
PID 900 wrote to memory of 1716	900	6150.exe	cmd.exe
PID 900 wrote to memory of 1716	900	6150.exe	cmd.exe
PID 900 wrote to memory of 1716	900	6150.exe	cmd.exe
PID 1716 wrote to memory of 2144	1716	cmd.exe	vssadmin.exe
PID 1716 wrote to memory of 2144	1716	cmd.exe	vssadmin.exe
PID 1716 wrote to memory of 2144	1716	cmd.exe	vssadmin.exe
PID 1716 wrote to memory of 2064	1716	cmd.exe	WMIC.exe
PID 1716 wrote to memory of 2064	1716	cmd.exe	WMIC.exe
PID 1716 wrote to memory of 2064	1716	cmd.exe	WMIC.exe
PID 1716 wrote to memory of 3348	1716	cmd.exe	bcdedit.exe
PID 1716 wrote to memory of 3348	1716	cmd.exe	bcdedit.exe
PID 1716 wrote to memory of 3348	1716	cmd.exe	bcdedit.exe
PID 1716 wrote to memory of 1632	1716	cmd.exe	bcdedit.exe
PID 1716 wrote to memory of 1632	1716	cmd.exe	bcdedit.exe
PID 1716 wrote to memory of 1632	1716	cmd.exe	bcdedit.exe

C:\Users\Admin\AppData\Local\Temp\6150.exe
"C:\Users\Admin\AppData\Local\Temp\6150.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2144
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3348
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Network Service Scanning

1

T1046

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x000000000F230000-0x000000000F354000-memory.dmp

Filesize
1.1MB

Download
memory/900-56-0x000000003D240000-0x000000003D404000-memory.dmp

Filesize
1.8MB

Download
memory/1632-62-0x0000000000000000-mapping.dmp

Download
memory/1716-58-0x0000000000000000-mapping.dmp

Download
memory/2064-60-0x0000000000000000-mapping.dmp

Download
memory/2144-59-0x0000000000000000-mapping.dmp

Download
memory/3348-61-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads