Extracted

• • Target

    33f44527100ab0e940ac9d10664cc70eda7285c4491c1b26acc4f96cccc4d96d

  • Size

    1.5MB

  • MD5

    862070f88be9b53009fadec1f3c4455b

  • SHA1

    51693d87e8ac936ded1131279372956c59644ba3

  • SHA256

    33f44527100ab0e940ac9d10664cc70eda7285c4491c1b26acc4f96cccc4d96d

  • SHA512

    26d2411866046541ceff11bd8fa0ba8c1e7ac461bee65496608ae904c758708de76410570e46bb45930953372056b739e47ed442db9e325fd15754b7976fd034

  • SSDEEP

    24576:lI8tXzEMohhJjvT+QPSBx5fCi6yX6N/9XSiOMEYAV20FZMTDH8W:lI89oMuaQPSBxpF6yX6N/dS1MEYAjZmt

  Score

  10^/10

  lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwareupx

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

  • SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

  • SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

  • SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

  • SSDEEP

    192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4

  Score

  3^/10
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/nsDialogs.dll

  • Size

    9KB

  • MD5

    1c8b2b40c642e8b5a5b3ff102796fb37

  • SHA1

    3245f55afac50f775eb53fd6d14abb7fe523393d

  • SHA256

    8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c

  • SHA512

    4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57

  • SSDEEP

    96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE

  Score

  3^/10
  behavioral5behavioral6