Overview

overview

10

Static

static

10

a5434b72fa...bc.exe

windows7-x64

10

a5434b72fa...bc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/02/2024, 02:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a5434b72fa80d4ed2bef826a36542dbc.exe
  • Size 15.7MB
  • Sample240226-dgh3jsbb27
  • SHA256 e32dc551a721b43da44a068f38928d3e363435ce0e4d2e0479c0dfdb27563c82
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
babadedalockbitcrypterdiscoveryevasionloaderpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\dotnet\Restore-My-Files.txt

Ransom Note
  • LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: C761DC4A4171AB30B15E4855144278EE
URLs

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

  • https://bigblog.at

  • http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

  • http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

  • https://decoding.at

Extracted

Path

  • C:\Users\Admin\Desktop\LockBit_Ransomware.hta

Ransom Note
  • Any attempts to restore your files with the thrid-party software will be fatal for your files! To recovery your data and not to allow data leakage, it is possible only through purchase of a private key from us There is only one way to get your files back: Through a standard browser Brave (supports Tor links) FireFox Chrome Edge Opera Open link - https://decoding.at/ Through a Tor Browser - recommended Download Tor Browser - https://www.torproject.org/ and install it. Open one of links in Tor browser and follow instructions on these pages: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or mirrorhttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion/These links work only in the Tor browser! Follow the instructions on this page https://decoding.at may be blocked. We recommend using a Tor browser (or Brave) to access the TOR site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about All your stolen important data will be loaded into our blog if you do not pay ransom. Our blog http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion or https://bigblog.at where you can see data of the companies which refused to pay ransom.
URLs

  • https://decoding.at/

  • http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or

  • https://decoding.at

  • http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

  • https://bigblog.at

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda
  • Babadeda Crypter 1 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 5 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5434b72fa80d4ed2bef826a36542dbc.exe
    "C:\Users\Admin\AppData\Local\Temp\a5434b72fa80d4ed2bef826a36542dbc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\sharpsvn.exe
      "C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\sharpsvn.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:2560
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5092
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3848
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3524
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        3⤵
          PID:304
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 1776
            4⤵
            • Program crash
            PID:4600
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1192
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1824
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{F59245F8-FAEB-4BC0-ADC2-FFAFB1D4E134}.xps" 133533900230520000
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
            OfficeC2RClient.exe /error PID=2792 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=1
            3⤵
            • Process spawned unexpected child process
            • Suspicious use of SetWindowsHookEx
            PID:4712
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 304 -ip 304
        1⤵
          PID:4240

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Restore-My-Files.txt
              • Path C:\Program Files\dotnet\Restore-My-Files.txt
              • Size 512B
              • SHA256 4349bb95519bf6ee4b3f28e059917d3a1cad2fb0fd6f54d8e2da706ed20c1476
              • MD5 SHA1 SHA512
              Submit Download

              Guide.pdf
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\Guide.pdf
              • Size 2.5MB
              • SHA256 f2d0e13a6ec546f169d45ad5b62ced1bcc3a4e01ae6dc3666239defc959e2baa
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              qclp-2.3.dll
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\qclp-2.3.dll
              • Size 3.4MB
              • SHA256 b98b6b7e4ca7f5827d8d5cb34b39a3f4ca8c3dac5d7751d64876d944301084ff
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              startpage_banner.html
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\html\startpage_banner.html
              • Size 490B
              • SHA256 d2d828c2c459b72ee378db6c5ac295315b8a783b7049032f92ed4fcb2a89684a
              • MD5 SHA1 SHA512
              Submit Download

              startpage_connect_to_data_no_mru.html
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\html\startpage_connect_to_data_no_mru.html
              • Size 1KB
              • SHA256 e4fe51c170e02a01f30a4db8b458fb9b8dee13a7740f17765ba4873fac62c5f7
              • MD5 SHA1 SHA512
              Submit Download

              startpage_connect_to_data_with_mru.html
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\html\startpage_connect_to_data_with_mru.html
              • Size 1KB
              • SHA256 e8f50f17c994f394239350951a40c3454e9b52b0ca95cf342f2577828f390a54
              • MD5 SHA1 SHA512
              Submit Download

              startpage_landing.html
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\html\startpage_landing.html
              • Size 720B
              • SHA256 1934657d800997dedba9f4753150f7d8f96dd5903a9c47ed6885aabf563bf73d
              • MD5 SHA1 SHA512
              Submit Download

              startpage_topstrip_no_mru.html
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\html\startpage_topstrip_no_mru.html
              • Size 659B
              • SHA256 3988afa43d3c716ecbe4e261ff13c32fe67baaaf1718eac790040cff2aa4e44d
              • MD5 SHA1 SHA512
              Submit Download

              startpage_topstrip_with_mru.html
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\html\startpage_topstrip_with_mru.html
              • Size 798B
              • SHA256 13683e06e737e83ca94505b1cd1cd70f4f8b2cc5e7560f121a6e02ed1a06e7ee
              • MD5 SHA1 SHA512
              Submit Download

              start_page.css
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\stylesheets\start_page.css
              • Size 2KB
              • SHA256 06db4d53adf4a1ecbc03ed9962af7f46fd3a54668d45907dc1737125e38ec192
              • MD5 SHA1 SHA512
              Submit Download

              start_page_landing.css
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\res\public\en\stylesheets\start_page_landing.css
              • Size 282B
              • SHA256 b3a99eea19c469dab3b727d1324ed87d10999133d3268ed0fadd5a5c8d182907
              • MD5 SHA1 SHA512
              Submit Download

              sharpsvn.exe
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\sharpsvn.exe
              • Size 534KB
              • SHA256 1f18a6384b6992bd479de73434103c79d1f115e2e9444de6b9a927892f938cb3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              sharpsvn.exe
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\sharpsvn.exe
              • Size 4.5MB
              • SHA256 799b8493ba4a618094833d5a0d9af0d16d66b2666073bf7a08d82315ecb04205
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              sharpsvn.exe
              • Path C:\Users\Admin\AppData\Roaming\SharpSvn Project\Advanced SharpSvn\sharpsvn.exe
              • Size 4.2MB
              • SHA256 2094fff49ee013aa1c30102faaa41a4a7d2418fe6b7ca482fe395b0da05e4cc5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LockBit_Ransomware.hta
              • Path C:\Users\Admin\Desktop\LockBit_Ransomware.hta
              • Size 46KB
              • SHA256 90f3a33919fdd766e90fd96f8f20a92c2d1376b7cfdc8b738c2f8e7e6c7498b1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/4324-326-0x0000000000400000-0x0000000000A55000-memory.dmp
              Download

              memory/4324-7391-0x0000000000400000-0x0000000000A55000-memory.dmp
              Download

              memory/4492-324-0x0000000000400000-0x0000000000433000-memory.dmp
              Download