Overview

overview

10

Static

static

10

54664bedb8...97.exe

windows7-x64

10

54664bedb8...97.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe
  • Size 146KB
  • Sample240402-pfvkqsaa22
  • SHA256 54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lockbitevasionpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\DVD Maker\de-DE\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?8B28321ABD4E73FFB353C75099A1358A | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FFB353C75099A1358A This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?8B28321ABD4E73FFB353C75099A1358A

  • http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FFB353C75099A1358A

Extracted

Path

  • C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
  • Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?8B28321ABD4E73FFB353C75099A1358A Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FFB353C75099A1358A This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?8B28321ABD4E73FFB353C75099A1358A

  • http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FFB353C75099A1358A

Extracted

Path

  • C:\Program Files\dotnet\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?8B28321ABD4E73FFCE3C614FCE871860 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FFCE3C614FCE871860 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?8B28321ABD4E73FFCE3C614FCE871860

  • http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FFCE3C614FCE871860

Targets

    • Target
      54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe
    • Size 146KB
    • SHA256 54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lockbitevasionpersistenceransomware

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (9374) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks