lockbit | b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24

Resubmissions

20-03-2024 09:55

240320-lxzn8sdh94 10

20-03-2024 09:53

240320-lwzb3sef3x 10

18-03-2024 09:01

240318-ky38dadf6s 10

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
Size

151KB
MD5

1fbef2a9007eb0e32fb586e0fca3f0e7
SHA1

3e86304198d1185a36834e59147fc767315d8678
SHA256

0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335
SHA512

94de457c74b783413514bc5804e86f5e1f0962dc03acf12d0a22c8b383b099518242314862417c24e5b13101b135d36dce285f4db11c989f3bc4331ce1b437b0
SSDEEP

3072:3m5H8y2mrr217uS8nW+cpsCp2cOy1cjKCy8YjKGiyWDDuMqqD/E0a3Hv/:3MHf2mr/Ww74cdlzXFqqD/Za//

Score

10^/10

lockbit evasion persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\DVD Maker\de-DE\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?83ED6257CCE5CF86E297E5433B05338F This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about !!! We also download huge amount of your private data, including finance information, clients personal info, network diagrams, passwords and so on. Don't forget about GDPR.

URLs

http://lockbitks2tvnmwk.onion/?83ED6257CCE5CF86E297E5433B05338F

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2696	bcdedit.exe
1168	bcdedit.exe

Renames multiple (8716) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2592	wbadmin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe\""	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Martinique	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105376.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_COL.HXC	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\local_policy.jar	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00391_.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099146.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BREAK.JPG	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\OUTDR_01.MID	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXC	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\WMPDMC.exe.mui	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18191_.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21336_.GIF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\de-DE\Sidebar.exe.mui	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239997.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Thatch.thmx	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_K_COL.HXK	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\SHOT.WAV	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.ES.XML	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\Restore-My-Files.txt	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2640	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
Token: SeDebugPrivilege	2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
Token: SeBackupPrivilege	2540	vssvc.exe
Token: SeRestorePrivilege	2540	vssvc.exe
Token: SeAuditPrivilege	2540	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1892	WMIC.exe
Token: SeSecurityPrivilege	1892	WMIC.exe
Token: SeTakeOwnershipPrivilege	1892	WMIC.exe
Token: SeLoadDriverPrivilege	1892	WMIC.exe
Token: SeSystemProfilePrivilege	1892	WMIC.exe
Token: SeSystemtimePrivilege	1892	WMIC.exe
Token: SeProfSingleProcessPrivilege	1892	WMIC.exe
Token: SeIncBasePriorityPrivilege	1892	WMIC.exe
Token: SeCreatePagefilePrivilege	1892	WMIC.exe
Token: SeBackupPrivilege	1892	WMIC.exe
Token: SeRestorePrivilege	1892	WMIC.exe
Token: SeShutdownPrivilege	1892	WMIC.exe
Token: SeDebugPrivilege	1892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1892	WMIC.exe
Token: SeRemoteShutdownPrivilege	1892	WMIC.exe
Token: SeUndockPrivilege	1892	WMIC.exe
Token: SeManageVolumePrivilege	1892	WMIC.exe
Token: 33	1892	WMIC.exe
Token: 34	1892	WMIC.exe
Token: 35	1892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1892	WMIC.exe
Token: SeSecurityPrivilege	1892	WMIC.exe
Token: SeTakeOwnershipPrivilege	1892	WMIC.exe
Token: SeLoadDriverPrivilege	1892	WMIC.exe
Token: SeSystemProfilePrivilege	1892	WMIC.exe
Token: SeSystemtimePrivilege	1892	WMIC.exe
Token: SeProfSingleProcessPrivilege	1892	WMIC.exe
Token: SeIncBasePriorityPrivilege	1892	WMIC.exe
Token: SeCreatePagefilePrivilege	1892	WMIC.exe
Token: SeBackupPrivilege	1892	WMIC.exe
Token: SeRestorePrivilege	1892	WMIC.exe
Token: SeShutdownPrivilege	1892	WMIC.exe
Token: SeDebugPrivilege	1892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1892	WMIC.exe
Token: SeRemoteShutdownPrivilege	1892	WMIC.exe
Token: SeUndockPrivilege	1892	WMIC.exe
Token: SeManageVolumePrivilege	1892	WMIC.exe
Token: 33	1892	WMIC.exe
Token: 34	1892	WMIC.exe
Token: 35	1892	WMIC.exe
Token: SeBackupPrivilege	2664	wbengine.exe
Token: SeRestorePrivilege	2664	wbengine.exe
Token: SeSecurityPrivilege	2664	wbengine.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2544	2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe	29
PID 2932 wrote to memory of 2544	2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe	29
PID 2932 wrote to memory of 2544	2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe	29
PID 2932 wrote to memory of 2544	2932	0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe	29
PID 2544 wrote to memory of 2640	2544	cmd.exe	31
PID 2544 wrote to memory of 2640	2544	cmd.exe	31
PID 2544 wrote to memory of 2640	2544	cmd.exe	31
PID 2544 wrote to memory of 1892	2544	cmd.exe	34
PID 2544 wrote to memory of 1892	2544	cmd.exe	34
PID 2544 wrote to memory of 1892	2544	cmd.exe	34
PID 2544 wrote to memory of 2696	2544	cmd.exe	36
PID 2544 wrote to memory of 2696	2544	cmd.exe	36
PID 2544 wrote to memory of 2696	2544	cmd.exe	36
PID 2544 wrote to memory of 1168	2544	cmd.exe	37
PID 2544 wrote to memory of 1168	2544	cmd.exe	37
PID 2544 wrote to memory of 1168	2544	cmd.exe	37
PID 2544 wrote to memory of 2592	2544	cmd.exe	38
PID 2544 wrote to memory of 2592	2544	cmd.exe	38
PID 2544 wrote to memory of 2592	2544	cmd.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
"C:\Users\Admin\AppData\Local\Temp\0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2640
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2696
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1168
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1700

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DVD Maker\de-DE\Restore-My-Files.txt

Filesize
1KB

MD5
b68a081bbb87ec3bdeedda9389af01c9

SHA1
df9a6f0bae567b9faa8863bff898c96e3f40b29e

SHA256
4ac1a1e5d7d976e9b665a4023541b62e25b51c6ec0ab05162d475a960c0fa0bf

SHA512
5cfe06f6e088e3bdb10c39d2b9bbbc2d91e51c7f973000adb533154791886864631a83c53fa8a7fd7e8364f13f71973ed7a5dad0aa1026648e078dc6c394288c

Download Submit