Analysis

  • max time kernel
    148s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 04:12

General

  • Target

    5735ea71ae9c58fe79c5049056421cf68600d6afdac1c441ae02291637779816.exe

  • Size

    145KB

  • MD5

    5ff46c6ec36501f106aa7373832bf69c

  • SHA1

    fc923fb8bb0fa7d52aa4b3421ea910d9d12a2809

  • SHA256

    5735ea71ae9c58fe79c5049056421cf68600d6afdac1c441ae02291637779816

  • SHA512

    9a1bd9624f02ab9caaf94381758ca809a73cc1deebe9ba55fb59fd71c003c72f81ee5339e92c673eb1c5f348ec5363f2ca5782391a8123c9b09a3f563f6c31fa

  • SSDEEP

    3072:8qJogYkcSNm9V7DXWw+X1gDW1YfJVKhFT:8q2kc4m9tDmbCDWqQ

Malware Config

Extracted

Path

C:\Users\sNLnicEVl.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted if you want decrypt contact [email protected] and pay bitcoin 20 dollar:bc1qzpa3j6qse5xfxft2xy7h2phq04wq9pk66lllz5

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Renames multiple (598) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5735ea71ae9c58fe79c5049056421cf68600d6afdac1c441ae02291637779816.exe
    "C:\Users\Admin\AppData\Local\Temp\5735ea71ae9c58fe79c5049056421cf68600d6afdac1c441ae02291637779816.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:4932
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:5048

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini

      Filesize

      129B

      MD5

      b267f4591d6432c2ea3842f36cb23890

      SHA1

      43c0ad7c7bb11faa849898ca9525eee4a86e6c31

      SHA256

      2ffb59c364a33737ce182b1983dfdc1f0987f38c88d80f1ad79264c6f5c37189

      SHA512

      48ec83b833451e8d6331d717ebd1e818a9b11113b61144a3c982660cf343be63344cee1e4ba6ca867ae3e03deadc53b1ebdfc626286ead8c5fbae7ce3ec351fa

    • C:\Users\sNLnicEVl.README.txt

      Filesize

      233B

      MD5

      885e5b5a0b7100068d7359be5025b479

      SHA1

      413e60216fd28e306c8ac910f7d317a88f3ea9e3

      SHA256

      3f8a1cf73e0f9fae26c30e80ff47c409799b697685cf31688e17e9f77e8e8ade

      SHA512

      804a5949d5d0cde73fb4c667b34cc14266a3dee9691277201f3bfdab99bfe1f8445ff64db8f5f2410528f4f9b96a5f069f90aaede998aa97489ea364f32e9b26

    • F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\DDDDDDDDDDD

      Filesize

      129B

      MD5

      91318b3e599e5e5becec27d3a103d3b5

      SHA1

      476dfaddc4f4dc4483de2c75572bc9818faa21be

      SHA256

      285e0f063e3ce8402c922a9bf059b0b08b795ad9998952e8b96ca97d7c641f6b

      SHA512

      d5203b90f8fec7908cb8577bfe538927c50fb744d868bf1c94bc298db2d3495e7d6f1ae60fc6548fb05d721b43926d0e619bf1f0c674773b006272fe72492981

    • memory/852-0-0x0000000002800000-0x0000000002810000-memory.dmp

      Filesize

      64KB

    • memory/852-1-0x0000000002800000-0x0000000002810000-memory.dmp

      Filesize

      64KB

    • memory/852-2-0x0000000002800000-0x0000000002810000-memory.dmp

      Filesize

      64KB

    • memory/852-2726-0x0000000002800000-0x0000000002810000-memory.dmp

      Filesize

      64KB

    • memory/852-2727-0x0000000002800000-0x0000000002810000-memory.dmp

      Filesize

      64KB