lockbit | b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24

Resubmissions

20-03-2024 09:55

240320-lxzn8sdh94 10

20-03-2024 09:53

240320-lwzb3sef3x 10

18-03-2024 09:01

240318-ky38dadf6s 10

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
Size

959KB
MD5

22e93a1af0bef6fb78f6054b93726f54
SHA1

6dbea516bd91fbde13203795f2128af13f158009
SHA256

0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e
SHA512

164b2eefea73fedcf9f0dbc77a068bb6ea9a3c0046ba46f951307f4849b6d67b2e0c045982de235e46cce6b1090caf55ea28563476730265c6af29ac87cb3c3c
SSDEEP

24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdCF:Ujrc2So1Ff+B3k796U

Score

10^/10

lockbit discovery evasion persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 86FE23AC7A3C78CF6B86FC97F41E99F3

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2492	bcdedit.exe
1704	bcdedit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\{EAFEE3AC-3C3C-78A2-A97B-A9BCEDD09A8B} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe\""	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\program files\dvd maker\shared\dvdstyles\babygirl\flower_precomp_matte.wmv	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\videolan\vlc\skins\skin.catalog	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\windows sidebar\gadgets\currency.gadget\fr-fr\js\library.js	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\pe05930_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\exlirm.xml	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\bg_texturedblue.gif	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\dvd maker\fieldswitch.ax	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\splashimagemask.bmp	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\currency.gadget\de-de\currency.html	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\currency.gadget\logo.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jre7\lib\zi\europe\gibraltar	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\so00452_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\pubwiz\adrespel.poc	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\mozilla firefox\xul.dll.sig	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0105286.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\docked_black_moon-first-quarter.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\db\bin\startnetworkserver	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\ir.idl	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_cn.jar	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\bl00921_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\so00629_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\tr00233_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\utilityfunctions.js	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\pagesize\pgmn044.xml	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\clock.gadget\images\cronometer_h.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\tn00330_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\borders\msart10.bdr	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\microsoft.office.businessapplications.runtime.xml	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\currency.gadget\fr-fr\js\service.js	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\windows sidebar\gadgets\clock.gadget\ja-jp\clock.html	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\windows sidebar\gadgets\currency.gadget\de-de\js\library.js	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\adobe\reader 9.0\reader\tracker\form_responses.gif	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\media\office14\autoshap\bd18221_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File created	C:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\Restore-My-Files.txt	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.zip	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jre7\lib\zi\america\cayman	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\so02263_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\media\cagcat10\j0300520.gif	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\windows sidebar\gadgets\calendar.gadget\images\bprev-hot.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\wb01241_.gif	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\asia\hovd	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\j0105360.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\images\settings_left_disabled.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\jre\lib\zi\europe\riga	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\document themes 14\theme colors\paper.xml	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\unformattednumeric.jpg	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\menu_arrow.gif	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\clock.gadget\fr-fr\clock.html	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\windows sidebar\gadgets\clock.gadget\images\diner_settings.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\videolan\vlc\lua\http\images\buttons.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\forms\1033\sign.cfg	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jre7\lib\zi\america\glace_bay	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\windows sidebar\gadgets\calendar.gadget\images\rings-dock.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\windows sidebar\gadgets\weather.gadget\images\btn_search_over_bidi.png	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jre7\lib\management\management.properties	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\clipart\pub60cor\na00433_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File created	C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\Restore-My-Files.txt	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_cn.jar	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\media\office14\autoshap\bd18252_.wmf	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
File opened for modification	C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\tab_off.gif	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
760	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
Token: SeDebugPrivilege	2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
Token: SeBackupPrivilege	1892	vssvc.exe
Token: SeRestorePrivilege	1892	vssvc.exe
Token: SeAuditPrivilege	1892	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 524	2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe	28
PID 2304 wrote to memory of 524	2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe	28
PID 2304 wrote to memory of 524	2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe	28
PID 2304 wrote to memory of 524	2304	0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe	28
PID 524 wrote to memory of 760	524	cmd.exe	30
PID 524 wrote to memory of 760	524	cmd.exe	30
PID 524 wrote to memory of 760	524	cmd.exe	30
PID 524 wrote to memory of 1516	524	cmd.exe	33
PID 524 wrote to memory of 1516	524	cmd.exe	33
PID 524 wrote to memory of 1516	524	cmd.exe	33
PID 524 wrote to memory of 2492	524	cmd.exe	35
PID 524 wrote to memory of 2492	524	cmd.exe	35
PID 524 wrote to memory of 2492	524	cmd.exe	35
PID 524 wrote to memory of 1704	524	cmd.exe	36
PID 524 wrote to memory of 1704	524	cmd.exe	36
PID 524 wrote to memory of 1704	524	cmd.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
"C:\Users\Admin\AppData\Local\Temp\0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:760
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2492
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Filesize
512B

MD5
e82cba0ce3b55c79b661a11d19845eb0

SHA1
e586715392fd4a81cc185fba513e6ce6c686f96c

SHA256
1d568493115ff36bae67765aa98702e5f911fc35c268b0057d835b2302fdc878

SHA512
838f0f3851c6e8cfc112e65aba848314e8100e52229a2cf061ddfcc63a31424959d67e3b2bb6e0cd31d57cf38224a0213166297cc02aaee3b7784ff2c488fabe

Download Submit