Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:14
Behavioral task
behavioral1
Sample
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe
Resource
win10v2004-20240226-en
General
-
Target
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe
-
Size
147KB
-
MD5
c1eb609c9ed588d372091d5531a74aeb
-
SHA1
faf042b6cef13d0d46c5b5e7f3f5a595fa0a5952
-
SHA256
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e
-
SHA512
828356900e5dc26d4e371b76504dfb4af3b4594708cb4acc76b22e69dc1766f5558ff55d0cbe0fa408fb97ca5741a08f6551b29fddebf6cddb35b6c0084a40c1
-
SSDEEP
3072:w6glyuxE4GsUPnliByocWepkEa9YmM31iA9uHZiW:w6gDBGpvEByocWeJhRFwAW
Malware Config
Extracted
C:\zvV4dTvWn.README.txt
lockbit
https://t.me/P3NT3ST_R00T
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
A6DA.tmppid process 1968 A6DA.tmp -
Executes dropped EXE 1 IoCs
Processes:
A6DA.tmppid process 1968 A6DA.tmp -
Loads dropped DLL 1 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exepid process 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\zvV4dTvWn.bmp" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\zvV4dTvWn.bmp" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exeA6DA.tmppid process 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1968 A6DA.tmp -
Modifies Control Panel 2 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\WallpaperStyle = "10" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Modifies registry class 5 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zvV4dTvWn 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zvV4dTvWn\ = "zvV4dTvWn" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zvV4dTvWn\DefaultIcon 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zvV4dTvWn 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zvV4dTvWn\DefaultIcon\ = "C:\\ProgramData\\zvV4dTvWn.ico" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exepid process 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
A6DA.tmppid process 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp 1968 A6DA.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeDebugPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: 36 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeImpersonatePrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeIncBasePriorityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeIncreaseQuotaPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: 33 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeManageVolumePrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeProfSingleProcessPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeRestorePrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSystemProfilePrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeTakeOwnershipPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeShutdownPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeDebugPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exeA6DA.tmpdescription pid process target process PID 2032 wrote to memory of 1968 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe A6DA.tmp PID 2032 wrote to memory of 1968 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe A6DA.tmp PID 2032 wrote to memory of 1968 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe A6DA.tmp PID 2032 wrote to memory of 1968 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe A6DA.tmp PID 2032 wrote to memory of 1968 2032 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe A6DA.tmp PID 1968 wrote to memory of 2436 1968 A6DA.tmp cmd.exe PID 1968 wrote to memory of 2436 1968 A6DA.tmp cmd.exe PID 1968 wrote to memory of 2436 1968 A6DA.tmp cmd.exe PID 1968 wrote to memory of 2436 1968 A6DA.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe"C:\Users\Admin\AppData\Local\Temp\7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\ProgramData\A6DA.tmp"C:\ProgramData\A6DA.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A6DA.tmp >> NUL3⤵PID:2436
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1501⤵PID:848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5c83332c873a925bf586fd9da225133ce
SHA1d70f899846987838065536781df7bf4c45484755
SHA25651139af27402fd65875e10124d42a563bfcaff825ad65463c41265bef7e852c1
SHA512841305651125f6c4034b84ab0044e2e592cf249aa16404adecbf0884b3fb898e94ac4852088e77985a74a7d09ba4527957a56f845486cff88356e58143b0d740
-
C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Filesize147KB
MD5b60c003acbed44a94c4add41b075386b
SHA1b9589e526e4ee99c739999c1ad6735b6f6f27494
SHA256d8dac11f8f11de56ef86c54144af0387d9772bdb22dba9538106ae9283b4c857
SHA5124d36a8b17d7f5fed641fefddbee89ccd2c255f013bd23d8a0747e3262d397aca7449e9022c322daa98e7f65acb4262a0e267eb59b8b7bc090087935ee9914550
-
Filesize
1KB
MD5b8223aa3012ad039db36737213646a16
SHA1780337e8fccbc6196e7d360cee27fe8e2bdf382e
SHA256a09e199dc134de29320ca5b10d3a881b991aeabf993e6c160fba6c701ee0e66d
SHA51281b9e12355b1eaaa0b6a338d9f9f0893d62262df344148509b8f4397dc4a3de89911e70f179f422546392fed03073d6368fbeec38fb61792402960c9a74d62ae
-
Filesize
129B
MD5d0909468a8e58aea1cbe416454f78799
SHA1fed37ef5919c07e15b8e2f8db9aed660b9e29ab9
SHA2561486984845762c9e9a632afdcb9320422d787e433277fc52a424631884c59cac
SHA512cb446abc88f1ba8e258f1742cf9e22395ad62c6cc4f35559a9a51c4a478eec61e45dd3becffca7364a66d001d4b033c8df2f3402968f0c9885dd53fa390e5067
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf