Extracted

• • Target

    1973ccbab82020881d531ccd1f2ca48e.bin

  • Size

    94KB

  • MD5

    89dabe88b04bc34579fef7df13539ba8

  • SHA1

    c3b24e2c4e9b0bac84bdff78c3781d4e49e02693

  • SHA256

    8e7a4b4a29df88ecefcf4a3dd6a22ef616f406c6ed207e6d4819795afeb163c5

  • SHA512

    a2ef4bf6f351707f1b51d616c62684a0ca9014d281e98974ea9f72778fda43bfd5a7b17b6ee91babb3ec54a55bbbd1f76b54f189eda10961fcd5bfd3282d3806

  • SSDEEP

    1536:H6B4axw9uiBA5x9eulET7GGKU0ZjtPZZhvtXbf4kyiTqUfWtrupFbLZ06brmSN:ui+9eu47NAZjtXvbnycpfWt6pbnmSN

  Score

  1^/10
  behavioral1

• • Target

    d20d22dd302f51341405794a8fb3866c234fafe614b67b55934a9a959a4cd847.exe

  • Size

    147KB

  • MD5

    1973ccbab82020881d531ccd1f2ca48e

  • SHA1

    7e18f712e26ea32b0e8aeb4cd3c958eb8d32dfed

  • SHA256

    d20d22dd302f51341405794a8fb3866c234fafe614b67b55934a9a959a4cd847

  • SHA512

    67654e67afe6a3e1ddf335dff4b976e254c45d8046853607cb4e98af6cd43accee8f2e35e296b932385bc9a6b7fed96ee4be6e113457eb5eb057bd8301f476f6

  • SSDEEP

    1536:PzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD8UhzyIccE+72p2Kbm+0ep3PeAM:wqJogYkcSNm9V7D8URMcS0ep3BcTT

  Score

  10^/10

  lockbitdefense_evasiondiscoverypersistenceprivilege_escalationransomwarespywarestealer

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Renames multiple (627) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies RDP port number used by Windows

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral2