Analysis
-
max time kernel
147s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:11
Static task
static1
Behavioral task
behavioral1
Sample
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe
Resource
win10v2004-20240226-en
General
-
Target
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe
-
Size
959KB
-
MD5
01c9561a15dc451562ba536d8239fa41
-
SHA1
9566de40d3435be6fac364e11d50d67d8a3c8dc4
-
SHA256
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0
-
SHA512
42c59fc3052ebcef309bfa2b9824841097cf6e115207da5bd26ccdd273f6382790c83bcd7f666aab045c66fb499d78b377cf4a369b306f1b67e635195f5c4a5b
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdxF:Ujrc2So1Ff+B3k796f
Malware Config
Extracted
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Extracted
C:\Users\Admin\Desktop\LockBit_Ransomware.hta
https://decoding.at/
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or
https://decoding.at
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
OfficeC2RClient.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE is not expected to spawn this process 5928 6020 OfficeC2RClient.exe ONENOTE.EXE -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 5108 bcdedit.exe 1860 bcdedit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{9C4157E5-4C4C-829A-39B6-39FFFC8E572F} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe\"" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\Users\\Admin\\Desktop\\LockBit_Ransomware.hta" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process File opened (read-only) \??\F: 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Drops file in System32 directory 6 IoCs
Processes:
printfilterpipelinesvc.exe5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\PPywlnm50qaqhdektmgt_rkw8_b.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP58o49lr_zzvzridhcjaw2ls5.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPc0gzem0hs23j85dh9vs2ujw0b.TMP printfilterpipelinesvc.exe File created C:\windows\SysWOW64\6341D6.ico 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\Windows\system32\spool\PRINTERS\00003.SPL 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\54A.tmp.bmp" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exepid process 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process File opened for modification C:\program files\microsoft office\root\templates\1033\timelessletter.dotx 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\s_opencarat_18.svg 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\net.properties 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\licenses16\mondor_o16enterprisevl_bypass30-ppd.xrm-ms 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\localized_images\cs-cz\playstore_icon.svg 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\search-summary\js\nls\pl-pl\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\office16\msipc\zh-cn\msipc.dll.mui 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\licenses16\visioproo365r_subtrial-ppd.xrm-ms 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\cloud_secured.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\office16\logoimages\firstrunlogosmall.contrast-black_scale-80.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\office16\msipc\ro\msipc.dll.mui 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\js\nls\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\ru-ru\ui-strings.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\7-zip\lang\ka.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\jce.jar 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\office16\msipc\lv\msipc.dll.mui 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\css\main-high-contrast.css 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\js\nls\sk-sk\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\css\main.css 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\7-zip\lang\fur.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\document themes 16\theme fonts\cambria.xml 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\themes\dark\check_2x.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\ext\jaccess.jar 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\office16\1033\winword_f_col.hxk 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\videolan\vlc\locale\km\lc_messages\vlc.mo 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\s_filter-hover_32.svg 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\rsod\osmmui.msi.16.en-us.tree.dat 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files\videolan\vlc\locale\id\lc_messages\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files\microsoft office\root\office16\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\videolan\vlc\locale\co\lc_messages\vlc.mo 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files\videolan\vlc\locale\fi\lc_messages\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\de-de\ui-strings.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\nls\nb-no\ui-strings.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\sound.properties 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\licenses16\homebusinessr_oem_perp4-ppd.xrm-ms 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\en-il\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\empty.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\office16\msipc\de\msipc.dll.mui 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\s_empty_state.svg 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\activity-badge\js\nls\pl-pl\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\licenses16\proplus2019msdnr_retail-ul-oob.xrm-ms 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\japanese_over.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\vfs\programfilesx64\microsoft analysis services\as oledb\140\cartridges\msjet.xsl 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\licenses16\visiostd2019vl_mak_ae-ul-phn.xrm-ms 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\office16\sdxs\fa000000027\comments.win32.tpn 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\js\nls\hu-hu\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\search-summary\js\nls\sv-se\ui-strings.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\microsoft.windowsdesktop.app.deps.json 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\share.svg 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\uss-search\js\nls\en-gb\Restore-My-Files.txt 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files\microsoft office\root\licenses16\publisher2019r_retail-ul-phn.xrm-ms 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\signatures\js\plugin.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\localized_images\tr-tr\playstore_icon.svg 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1688 5064 WerFault.exe mshta.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3236 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\WallpaperStyle = "2" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\Desktop\TileWallpaper = "0" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Modifies registry class 15 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\.lockbit 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell\Open\Command 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\ = "LockBit" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\shell\Open\Command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"C:\\Users\\Admin\\Desktop\\LockBit_Ransomware.hta\"" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\Lockbit\DefaultIcon 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell\Open 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\htafile\DefaultIcon 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\windows\\SysWow64\\6341D6.ico" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\6341D6.ico" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\Lockbit 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\ = "LockBit Class" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\6341D6.ico" 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exepid process 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Token: SeDebugPrivilege 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe Token: SeBackupPrivilege 976 vssvc.exe Token: SeRestorePrivilege 976 vssvc.exe Token: SeAuditPrivilege 976 vssvc.exe Token: SeIncreaseQuotaPrivilege 4332 WMIC.exe Token: SeSecurityPrivilege 4332 WMIC.exe Token: SeTakeOwnershipPrivilege 4332 WMIC.exe Token: SeLoadDriverPrivilege 4332 WMIC.exe Token: SeSystemProfilePrivilege 4332 WMIC.exe Token: SeSystemtimePrivilege 4332 WMIC.exe Token: SeProfSingleProcessPrivilege 4332 WMIC.exe Token: SeIncBasePriorityPrivilege 4332 WMIC.exe Token: SeCreatePagefilePrivilege 4332 WMIC.exe Token: SeBackupPrivilege 4332 WMIC.exe Token: SeRestorePrivilege 4332 WMIC.exe Token: SeShutdownPrivilege 4332 WMIC.exe Token: SeDebugPrivilege 4332 WMIC.exe Token: SeSystemEnvironmentPrivilege 4332 WMIC.exe Token: SeRemoteShutdownPrivilege 4332 WMIC.exe Token: SeUndockPrivilege 4332 WMIC.exe Token: SeManageVolumePrivilege 4332 WMIC.exe Token: 33 4332 WMIC.exe Token: 34 4332 WMIC.exe Token: 35 4332 WMIC.exe Token: 36 4332 WMIC.exe Token: SeIncreaseQuotaPrivilege 4332 WMIC.exe Token: SeSecurityPrivilege 4332 WMIC.exe Token: SeTakeOwnershipPrivilege 4332 WMIC.exe Token: SeLoadDriverPrivilege 4332 WMIC.exe Token: SeSystemProfilePrivilege 4332 WMIC.exe Token: SeSystemtimePrivilege 4332 WMIC.exe Token: SeProfSingleProcessPrivilege 4332 WMIC.exe Token: SeIncBasePriorityPrivilege 4332 WMIC.exe Token: SeCreatePagefilePrivilege 4332 WMIC.exe Token: SeBackupPrivilege 4332 WMIC.exe Token: SeRestorePrivilege 4332 WMIC.exe Token: SeShutdownPrivilege 4332 WMIC.exe Token: SeDebugPrivilege 4332 WMIC.exe Token: SeSystemEnvironmentPrivilege 4332 WMIC.exe Token: SeRemoteShutdownPrivilege 4332 WMIC.exe Token: SeUndockPrivilege 4332 WMIC.exe Token: SeManageVolumePrivilege 4332 WMIC.exe Token: 33 4332 WMIC.exe Token: 34 4332 WMIC.exe Token: 35 4332 WMIC.exe Token: 36 4332 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OfficeC2RClient.exepid process 5928 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.execmd.exeprintfilterpipelinesvc.exeONENOTE.EXEdescription pid process target process PID 3720 wrote to memory of 4128 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe cmd.exe PID 3720 wrote to memory of 4128 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe cmd.exe PID 4128 wrote to memory of 3236 4128 cmd.exe vssadmin.exe PID 4128 wrote to memory of 3236 4128 cmd.exe vssadmin.exe PID 4128 wrote to memory of 4332 4128 cmd.exe WMIC.exe PID 4128 wrote to memory of 4332 4128 cmd.exe WMIC.exe PID 4128 wrote to memory of 5108 4128 cmd.exe bcdedit.exe PID 4128 wrote to memory of 5108 4128 cmd.exe bcdedit.exe PID 4128 wrote to memory of 1860 4128 cmd.exe bcdedit.exe PID 4128 wrote to memory of 1860 4128 cmd.exe bcdedit.exe PID 5944 wrote to memory of 6020 5944 printfilterpipelinesvc.exe ONENOTE.EXE PID 5944 wrote to memory of 6020 5944 printfilterpipelinesvc.exe ONENOTE.EXE PID 6020 wrote to memory of 5928 6020 ONENOTE.EXE OfficeC2RClient.exe PID 6020 wrote to memory of 5928 6020 ONENOTE.EXE OfficeC2RClient.exe PID 3720 wrote to memory of 5064 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe mshta.exe PID 3720 wrote to memory of 5064 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe mshta.exe PID 3720 wrote to memory of 5064 3720 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe"C:\Users\Admin\AppData\Local\Temp\5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3236 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4332 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:5108 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1860 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:5064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 17763⤵
- Program crash
PID:1688
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5828
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C6C9424A-B6F1-47B5-A125-DFA1EA5CD86C}.xps" 1335486313679600002⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exeOfficeC2RClient.exe /error PID=6020 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=13⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
PID:5928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5064 -ip 50641⤵PID:3628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD51c47cfa6228a221f549bd8e2374cdde6
SHA10916a136e084c98ff92d8a79bed302933b0e202f
SHA256ef4baa233b67d61256434f553d99d6685561d1ba77113962350afc79570ca149
SHA51297bfb565990f9b463788982cec0bb4a3ca13017f84a5653e653fb131185104455f8817f1a86f1e377eceb23d626c2289cc69605db7f557bb1f3b0d98328b908f
-
Filesize
46KB
MD5c15c6adc8c923ad87981f289025c37b2
SHA1bfe6533f4afe3255046f7178f289a4c75ad89e76
SHA25690f3a33919fdd766e90fd96f8f20a92c2d1376b7cfdc8b738c2f8e7e6c7498b1
SHA51231dd03b208e00ac012fbe4189d5af1306cc8e3640d40efefab4aa1cabab3c4735eef0cb65e7750c3c77021934e145398e5e26389975cf36b193c8f622a5fde83