Overview

overview

10

Static

static

3

ec88f821d2...8d.exe

windows7-x64

10

ec88f821d2...8d.exe

windows10-2004-x64

10

Resubmissions

15/02/2024, 06:13

240215-gywlraaf8z

15/02/2024, 04:36

240215-e8d4cagf6z10

15/02/2024, 03:42

240215-d9nthagc9510

Sharing

Copy URL Twitter E-mail

General

  • Target
    ec88f821d22e5553afb94b4834f91ecdedeb27d9ebfd882a7d8f33b5f12ac38d.7z
  • Size 35KB
  • Sample240215-d9nthagc95
  • SHA256 63b9637406042b4a9ab162e581c935e7f2c20b64ca504c4ae4e947aa43565b52
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lockbitevasionpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\Internet Explorer\SIGNUP\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: EJ2DNzwlGROqG9DDQgNjQrMVVVxKXXFp0hsbPgUu82BwtTUN4N3l5N6qRWf9G1eA 0lOvyMgh6HugVwu3mPdELiqjHPv+OGIawztNun1PjE8NIDJqBUrOPUk2nYXN12lx 405NWZk0adRbRP1bUD0DzM2OUkSuvusLQq/KXsCYTUaSz+B0hkIAuPZLH1Phb/Yj sU6D8vrMpScQaXSMet8mPdXRM9i4jI/Bxefzir+E3N4gNTCfIXsSP9IaCcaNGvNH DmU2DolZW+R4z2FfFXhgWEiYVlCRVRYjgFyhLm1kT0OuNFMQTxy/oaaM8AYFviyB YVooBJoxPLsl4ZmhaUnhCk5EMs2CKvuzHhAtpqhWPjZ5Nj3NqAV33+DrHnQSe7ec tdpyfBiR+xBRvsna1Paqv9elsR5Uynlkfd6aWITR+JRLfIxlzeWRiN9miZVfG5mm rvZ07coc5HnImXPe9zqoKZzLVQz88nRjbo6Oxif37r97br88/WF5FNkdGFz1JeD6 RgBSeQ3Vd5svEvDPbi46E23Tha4Qa2y+7eVaO3VwE0eJ8qcLrA34qKBylD/pEaES mqMuTU/1MS/W/bFFIzaZCIwEfgx31SEuKWJ1AMA/l81bAc/bmnLy0WjoY6Wc6OXJ dR+DCmzFVvW4AkQA7+k9oMOk67XGaouz4iomUtGXIYk0SYEE+i61eUWGtZmQNqQk 2kChA9qgI6dJews7Qd/K+S6t8LLKHDOGko3ozt9YxBKtfcWnvOma20yTkWBApRVw s7AEfhVLN7VjDH4ttPp926DOED7mKBTMqr+mNXrMlpSfcFSs6GmwcetqlAzMKHDP 0JegmXwoyOLH6X2mKVYVS7prd/bGEHBJhWkTBXzxSRWNDTr0ay7fXn0XI2S8TRGD CGVkoGJI5K5x0D3nZaN+KTJf7Yx4eqML8n+PJc5mrD+c+ULA4vKVOraiHYHMeeAv gTWgeSeX3CdoDAmB3/WPgmHf6C0mm5t/ghcDzNUeaabgD38W8GlNkmp33oXiGWcx SQ5vmnYbZKoEhUvx9j7sy4VKcVD1WTBz9Pnyz+AQ457Uggj6I0eLKOyw9zWIUEdm Hs8bCMWwChUHkshmBecAy41ZypwHclwJcZPw5nwsNsn4m7J0kznuAs2b5a7cTAXJ cwPi/6PwpV98On+Ctx7lWFrE5KECdmOhKSJFUxsiIXnz0ZSlvQE40AnCfYGNQUZd B9r12LyNZEltuEi313lvatk0/1wpEJVRAAWOmi/m5RZgOrn/TlQYGdmpm3vB6YeZ CWKKBV1BsUrNHans0XZHm21WYOt8ZIJY52dFFj/b0nB2ALPaS0EOokK62rdGOLuA wl/kPp7IdzYmkt2GmFD+mE/JJq0XcuF1O6n04UbN4WCpwnauPBGrFK4loS7h3wym yTMVU7qx05BMfgq+2Ms8DAIExZUghuK18er0t/fsHqLaKmUE/Jwo35fS6AnGdaBJ dkCwZwFxamGjosKAQ/nrNpgWU2lPI5yGEeJJdEJtw6aTZSDyRnv/k9OkQLC3sD8f ZkB1tW/Eod/nYSkzym/c0V0QMClYDmsXIKtjP80bVK7FIqz5tnUFeaxaYcYlDrkH vbpM7IC8zv+HxKRLAETOXqD4MvVmF9ZchTtLUsngIGNbbphB5lOSwIzPIxmKVMde L/b7D4mbnrWFH10sGhnkauzU8f5kF/QwkvV38tfswTk=

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: ISw6NjhHr1GSP0NIr8jrNvQEctdy8JptElrvVxagL4fHHZy56FsuW4DAYksL2cjD HUbMOKMdE6RRLKIS4uzS5uaH4nrnvdRC7GLQLyHfhK6uRv8ugGWGtnX5tnPNueLv TQ6b3NBG14bgWxoDVeXYQBwdb6rQh6HE64eqwVQHJZjzuEgnBiVpGu2H2tdreisz ypVvLV07y+Cu7MW1mImv+TNXRjeFIImHpGrNpoL4Y2aM1g2uUd+5GLHObniMyHvJ 361ErHMT9HJfVH+hrKi/539otOu+2KGN+w/47JyCldcVsx4YigvJHS4iCb9bztVv ZRFOp+3FYDytj0fS0qrNCR4L2tZ5M5zeLsaH4KcHeGaIWtPEAq6u5t/Bbfh8AQkl ELDG9YUP/TklimowJehnH6Z/zRIyMef/ia6npdlbkIldpHm9ROitGnxX4IPKdhh1 8duhD5WmvsKspWeP/Qx3EQxt9wz442CL5I7mwHBvPp4xNaoVk8fg8xA+8wZIqm/y ANP0YhFoj5RLr6qAeK5u1K0Y85qOIodevuOXZq0M79u5BkXKc2nU68i81irM/orc yp2keTSb/CSghZYSGRLtlR7oe6MEhhs9uaAk4XhVjVrWbNMYBhCjjP6rkAjGKSB9 WBsrqJ6V28aaXP6UcTeCTRQhSk9MNGUXQ6wWWHsFZBUXH7hc6V2XUlCt7yFqr8y4 zo1aMN3hUqoN6MHkEuds+NGTJmhi5bOj+ev0xwrJjSranxCbRrFvBHZCDDKZCOFQ w8y3XtToRkAkqS0nyxM7sL+8OcTsWeF7Z8rJGlYRBjdN2yZXT4nrQEvsADE8/1NM CfjsiPKC2iRbAB6PO1nS5ffYdpyf3tlw3efs8djDsfA9POKbMvMHWnHHpwXrGzPl rCGhFHViNNtHwmC1/59lCQ8g6/GiavW5iwBJc/+QG07j5hkedgIVMYIbdVLq6GLk WE/jCDJX2n46kHNDrMnjg28vg9cAwyaC9d0Rf6BAQ0Zr1w8OmmbswRt7HiHP00RO PdfkRDAc3irqT1cc7eAW/C9sPBFxTLRcB/OgkMUfJ7DfpefDfDQscMokDpVX+v2j 1zf7ixUX07nrd1h0+Vn/UT/Mgv77WT6e3pKC7u+LKDstuhqX19k4QTk/iJe/rNeH jzNp5QqRrbtWZQTj/FwO1xr0RBgPpdxEzGWFgBokkr4a40HKAXhOwapf4bgDrzcw HRcJWtP1gkWaVcBfh24KlvZrjDIXo50C3DBRSbHKNxD6l2jT3ccjZnrs/wiZO7HY N6dtNRyENXAXIM8DFybvTBYERENlL5EY2FIvk7IqekObe4L/sJXdDDOqLHuPc4eS 0ZtoC8nR6KxlFKdUSz7fhnpqHKIKlPcvmL0Q3ZLmlFhsJ0qbw7PzXh3oGrXfWfyn 4OqXbxX4LyI0kygqgugDHwR1i78hv5S1j52tLR5rUEGgkg2SEZ9DHbG7W7VLRMMx XVjON3mBwhYtWt3XKEkIqVEsstFBl84DCZ1SMrOjDuQY+GK625HtpIM7hY1/jYEd /gHf2XhZ+8DN8qPBGWy/UEx0ZGWuK/Ny1u6M2S9Ixfi8vAaZYHrpv/JA2z7ZfSgd Ryhc/+QNaxIYqW3rF+n+7O6ZTccyL3klefTROOCt1XYI/KrKaGPhXgttN8hMCuns 56u+w1L7sftQkGGd9b0To4zWPKo2z0mDjwqaMk4WpxE=

Targets

    • Target
      ec88f821d22e5553afb94b4834f91ecdedeb27d9ebfd882a7d8f33b5f12ac38d
    • Size 80KB
    • SHA256 ec88f821d22e5553afb94b4834f91ecdedeb27d9ebfd882a7d8f33b5f12ac38d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lockbitevasionpersistenceransomware

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (7488) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks