General

  • Target

    00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8

  • Size

    862KB

  • Sample

    240314-em82laaa5x

  • MD5

    96de05212b30ec85d4cf03386c1b84af

  • SHA1

    dbe5243c6ea5cc4cfb3edf042bd94a59cf9a0e64

  • SHA256

    00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8

  • SHA512

    3a77e9dad5348a612ee83284ed7e098cc19375a92910756bc4d9274f484a68b0a73ce39fef53a1d12fecccc1daf5d48a1d264c18b1fe8ed4741e1a95cbcbdf47

  • SSDEEP

    24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q9F:dAfSrWW4g+7Ht+UmxJe6

Malware Config

Extracted

Path

C:\Program Files\DVD Maker\de-DE\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 172375D30BE340B43DFE793C8648299C
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Program Files\dotnet\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 172375D30BE340B4659906404D8E3E4D
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Targets

    • Target

      00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8

    • Size

      862KB

    • MD5

      96de05212b30ec85d4cf03386c1b84af

    • SHA1

      dbe5243c6ea5cc4cfb3edf042bd94a59cf9a0e64

    • SHA256

      00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8

    • SHA512

      3a77e9dad5348a612ee83284ed7e098cc19375a92910756bc4d9274f484a68b0a73ce39fef53a1d12fecccc1daf5d48a1d264c18b1fe8ed4741e1a95cbcbdf47

    • SSDEEP

      24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q9F:dAfSrWW4g+7Ht+UmxJe6

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks