Analysis

  • max time kernel
    84s
  • max time network
    94s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25/02/2023, 07:41

General

  • Target

    6a98b2b6e37c7c92368548e902e9a139_modified.exe

  • Size

    512KB

  • MD5

    58b1064c6417659bdd71dd9047cd0443

  • SHA1

    df06d4fd095b0f2d80141db2716e3fc673c8ff98

  • SHA256

    c54b5dc58fa48c51cb899eb0a50af02514f9d2c37526b1808e797b9017a0e6f9

  • SHA512

    c28300bcf2cdb048cef3796cb2a6d9c8c484f623ced1ddec232c3b20217a3532355ce6ca1ec607064355fdfef72c467ca8bf53458e1b7973c4c67b641af6bacd

  • SSDEEP

    12288:IyPQxK0GtV6Yc2rzgfur479pAZDATfzmRf9mC6H:LQk/tQz2HWFNTfzqfoh

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\bin\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: D167D5D82822CF4A743FF859195BB13D
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a98b2b6e37c7c92368548e902e9a139_modified.exe
    "C:\Users\Admin\AppData\Local\Temp\6a98b2b6e37c7c92368548e902e9a139_modified.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1688
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1296
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2100
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:224
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1768

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Java\jdk1.7.0_80\db\bin\Restore-My-Files.txt

          Filesize

          512B

          MD5

          a09d956ceb2a16c927631ec694434b96

          SHA1

          031d5e37626823595cd04522a4bdab02d56b6e6f

          SHA256

          4c7b0262087212afcd08f4e08ca30050f31833783895f1d3640523e87892819f

          SHA512

          c98898a7977266170bf542eaf090872df02e2b7acf834c9aa0c61516db0433d69e92cc44eccd3c4de53b5721f9b29e347d2a33eb00972f32e33454be55a24b7f

        • memory/1760-74-0x0000000002BF0000-0x0000000002CE1000-memory.dmp

          Filesize

          964KB

        • memory/1760-2570-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-3985-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-4656-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-6792-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-7545-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-7738-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-7742-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-7743-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-7744-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB

        • memory/1760-7745-0x0000000000400000-0x0000000002BEA000-memory.dmp

          Filesize

          39.9MB