Overview

overview

10

Static

static

3

ec88f821d2...8d.exe

windows7-x64

10

ec88f821d2...8d.exe

windows10-2004-x64

10

Resubmissions

15/02/2024, 06:13

240215-gywlraaf8z

15/02/2024, 04:36

240215-e8d4cagf6z10

15/02/2024, 03:42

240215-d9nthagc9510

Sharing

Copy URL Twitter E-mail

General

  • Target
    ec88f821d22e5553afb94b4834f91ecdedeb27d9ebfd882a7d8f33b5f12ac38d.7z
  • Size 35KB
  • Sample240215-e8d4cagf6z
  • SHA256 63b9637406042b4a9ab162e581c935e7f2c20b64ca504c4ae4e947aa43565b52
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lockbitevasionpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: K+ek05q/d7ToAyGlQ27z2mJ/Px0sKyfFNDPSUSUBgL+KpqkAyHJNgP2DpLFST+JC wxf4vSe8O5GD5CekfBD7U4veydW6JW6sVBrDJnUwB5CXszkrHz8gPFjlRmJWIwKz 4hkOlXjX2YAE8L0R4JLX4bJFflSwFllsakk6TaVp8Ophhgy+idBvKkb4JB1DxanM tTnpMZFLQw1HnKEeLJcEPyhM7khfk3Gwz0+A7fU2aIXefE29fyBSr6d2vvRmvvrI 5dWymxegjkonDT4GFhu7E5NJKDiBcBLsAYLDnk8blCbsgE5Vy63l7LudFA359ylX hOV1+BJZIcQrGy6RjGct1YJbynG8RmrfhJXcgDcHFkQudFXB2nFKMZp4TWLzHhkU Cp7fSHOZVf7l2lCJbhpyj5I8mXZlHgF7psCR2WYuN5shSy4AFFwuivzijQKXvjyM lgMvLL9lmZklnj2/E+O7Afa0noX/Hhw4z4BPBgcXq+PK7k6ApwKDOYYOrUSvghcr VT5WwmSr/JwqGM6+DWx9S18szSsB7q8oDEUGbUhw/b1pi503vZ26iwOVEs+rDb83 HAKIULi9jcmdauZikE7CpBnBJsHvY74qobK62vfVus5zX3FSJJe3L+87MAZ5moYJ Uis7gnaop6aRFi5jFEU9CRiMgBxHNa7znSZ3mEhBDvVaKiKb1FurgD9yf9dnm1wO AvNkM6w5Iyq6tIjLIkBsF/hnQAn2ii985+Jfl46g9yTzAfmjrBxCe+v5aZ67wVds 3QxUHDpIhjdCelwyKUFk8GShdStExaBYz6cwltOxaNTD2iQ9XLJ6CJQAd3oXFNE9 I6NFD9DJkftr47KCDOg7Egp0KwkkcP1MIOeiFQfxHBGpqaiXCUJ6nrrXLfZGc3dw xQ3kH0EUeMPwZC3aBbs9LSS475xas8z8TQh7hW1hbFf+IUEQKWJ56H/N81yTY33D 98CDfxmarI7ih9aYa3M+YJ8WDPOCBLP7KWg/NRmHUvQ6qOTBeWLID8X//kw/GNrS aSMyhmipyABMbIOfI6xzw/6kBiFcuk/wkISSpwHSXRbgjE1f9pgK9DqgPg1zln3D DDMVl/TyxbpORKpzyXjWe/v0q+o5LdjvpaxKH0NTO4VHReoCaZwCGVbv3JgrEp/C TB9kYcJK6nwhuJWXtru5O4eZoDkUch8tJgl9s8xSPl13zPFFRpcDzFLyrmnK8jzH HzdYYYo7/I/gaBNjg+7ugLB1kBaw6+rVlKnh8p580LSaSR0RVJO9B963szkDoiKv L8CkCj9A/z7XzeS7E6ktPwYXOfi3aU+s/X9YgF40lRMQ2BMIOtlJhTGYxRPhsniE Ge8taIc8bIHGitGyjTm/Xjpzj08MKYoXqy5Elmamd9Yw52x8hM7uAXyqBw9y0JYP GijPPp+s1lDXp+///QGTMSd4VI6tcgX+p9MCDZ1OJOgZNdRLQVwDmmA9E9l1AFVU oVdDFGrdpoAyHongZ8ILqukQkEj+j4AQ7yVX9OeLPc6ZWvxACJTTD8E5BB7gJ51G FlrqO2DLx7Is4W9vTAvc+mJ5L4sQvPtPzuONWK3Ij8bJTGhYK9LmzZaqZvExadrs zHUXUgz9n2NmH18rJC05Z8Y7YvidUcTJ6fRilGbL8/oel1clP9GuP0YKmnDAgsFY 5ktFWbS1FaaVHVvf9tNQICLWT5lMqTY9Fzfrm+vjRAA=

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: MMvDRWqYeTPFORNCoNAYEaxfUgvc10Mq+CBqSrhrFU/64upOVi5wLN30LFKB2NjG kn3EGmIDXJxgBmP16T9tkVw2a6e44SUsGykMwx6IKIfK7sgkfwoqkE3V5lFpY1Ju G2Q6afSh4BqRTrPEUra08mQ7jRAgFlWAvnXgSijybHr17mMkYuK+zJooREj8J0zV hY6ZW7JGowPp/kItKYr32euGNlJkgCyyikmOvrT0RunhZLvLq5plE4bRYNr156yn Efvarc+gvazOph2unZddz+ZnZpLvMVs7y3m1WAOD6IWcbwPLu+rMb/BWpgfVIghk ivLU8/CywzeVHy72Tw2oGlfNlBKdz5Zbm1zzd+kKWhdl0UC54itvoEeL+PH/c8tP 6CM5k4HpWawAe3llb86zCBLc3g/nHf+EcbOnTvTNt1UVhl2eYsm5kksinwYM0/xO +ciHmRIqrv4Arh2MubvihKOYGHs8inpfZFgA6gVRyWbWIzo/ypndKL3wiNR8MzUJ VeL+TBpQZhP3acOOZc+hCGkgAwp3X2kHYP0lFFjB4AOmTMkfqsNBI2Xf7JENUquW wNEmPcpwl420YIjHTy/K1svYU104Ayww0qbGT/KT6mex+bIjrz0+5BGTJ58bicmC smCwiM3tpaS71Jn8ER3dt+KYEgymzauGDyssfmEpWjR13V0JXy2IvskBsoJ/eHVk G7Ohgz2s/w1P0hhfSkyBpUmn8Bm5IkQ9CCEQhfam9tpx5BByPfkg2sfqKZbO7GVE sLaQxzLYE7kDR5L8Lvbxnpsue0PxyqOijm71pXng67q75d12Y/S+yHGd4bDhzRON 7zi+CntxFaBQi+LJFDv1USvfV4NCoZbGKgzAV1bMLaqoufODOdWezgb0KlXur6vI fnQUuZ0SEJuDk3aq0MlebofSRcPp1l1TL4kUHoVGs7WFhmSdVyl6Gkhv+obW67f2 Uph40TCbBPGAMGpUQxDbPRktN9eAz+Wwg7a+YtwvZN3KLvDPveIJiAXmFm9oax5l W/UYJwFp4XodO5PzZk5B+s9k3vk8xrSfD/izVTndAtJ7GkJ1oVwfIXcr5A0UEG4F ZQb6TA4eYVU5CRVXuETXDeHHXB40DsTB52ddK+a7RdcLHyXg91tKQcCgqPRTI9g+ tc4+oapNJwD9QG2GFcfBvtvA5DK+0nznkD1O8MR5FDCFa3DNUsJG9ONqIS7TBtgh OlVQOnGmmRRS0dniWgfx05Kekyu2TYpCf9ReA5NcgsYzXP2voD32l2BtZ6WlnjQG aPvb0d6M92EwzjGuxDs9itsYJcNjKNUIc97lE+pDSmOVTQKbUenBqtGzMK1wopzt 3GbtmoLKGAY1nRhHvAqtUTa8fNe3ElsthjaaNqf/ur/mmA87VT7i9dd4v9b+7fBM ekC0Bn13IYZn+abXsgLnNuTtNfidilDXIVgYpzysdUBFLNri5j1slrHLOt3pCnJS ZxA9sHRmQaQEO/jLRklGkadIfCGebC+zoFk2MuwQ/xlFr/v0xNl/q4u3Xl220tD6 GDZuP7svdz3eZ/Nv6syCpm0K20BWVFXkIKkXyjVGlJXCy8UhVRFYH3JTJHXC6GLu eqZSOpu7JsmVtz0jdyO6Kws/5IJQOdosGS1SJ18W/HZUPcaaI/1yRtwvV5qELTd8 uIaRhas4GHSoAgdBqLOw0Mo6qmokLE9LCC028eFc/mM=

Targets

    • Target
      ec88f821d22e5553afb94b4834f91ecdedeb27d9ebfd882a7d8f33b5f12ac38d
    • Size 80KB
    • SHA256 ec88f821d22e5553afb94b4834f91ecdedeb27d9ebfd882a7d8f33b5f12ac38d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lockbitevasionpersistenceransomware

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (7475) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks