Analysis
-
max time kernel
104s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-08-2024 12:22
General
-
Target
806e168e6d95f8dc90ed984ede4ca240N.exe
-
Size
153KB
-
MD5
806e168e6d95f8dc90ed984ede4ca240
-
SHA1
a2c811394710c5ac7c81003b4fc333abd6374354
-
SHA256
a1045af8c4a99804f0ce1ff4341fdbba23dc368d553f5717b1a728c9b86dd614
-
SHA512
7c7a9c9b30fa6561ad9bef723fd747b32fc31bcdbae9de33fb1b1c9f7a4ab2f37da8d6ea27c36e01fbabaa9504a683381e46c1781c1a195a3c365ef94c79bbae
-
SSDEEP
3072:EqJogYkcSNm9V7DP6yKVnNVlbykoAJlFUykT:Eq2kc4m9tDPGNHbypA
Malware Config
Extracted
C:\SI6FTXnq7.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (609) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\806e168e6d95f8dc90ed984ede4ca240N.exe"C:\Users\Admin\AppData\Local\Temp\806e168e6d95f8dc90ed984ede4ca240N.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\C2A5.tmp"C:\ProgramData\C2A5.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C2A5.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{55DD44EE-0B91-4148-84A5-FABE0F59E9BE}.xps" 1336880298986100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d1d2b067e8164cb99ec239a2324552b8
SHA12d7cca8552c7bf1f02f89b4b9527197c42438a40
SHA256b98d0d532be4033f9bea39f31dd886e876234d8ab6aaaf21fe552bb9c1f8131e
SHA5127795bbfc7cc042d92a5be23a2b36b6e3506abf1df7bfb1668c537cb000d747fe6b90669e64a4b0c11391b2fed57986f626cde0db3d5edcdd49a5b5098c428238
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
6KB
MD5b4975ef3f930d2f1fdfe289a23ef1875
SHA1adb4f6b47b2be9411c321ea818ab30321e64cd30
SHA256a5d4813276350c57817344fb8840870269ed5d7363a3027138c8bedddb67393d
SHA5121b6f2e77addc385d305851ca506abf53f0ce97f5b2d4c2090a74dc8102025012c46fe2c80364e42fb207ef0db469f33c4076b6ed0c85c9f1bad461632d1181c7
-
Filesize
153KB
MD560700bd12128b9a9ccadc728dfa925f9
SHA182258d628051d10c30e201f3a51d9c077a8fbc7a
SHA25651dc7d9bf3888940d1d4c386cbeb46c25204b583ecd482bb3eb0841d74caffd6
SHA512548b8e72ce46bc88d8e48f265a56f1c25a55c6d49ccf32135fb28c102efdca438dd1b5903b8defcb71c3a880e70167bb03ae7c8b7c91227030902fbb22b15b55
-
Filesize
4KB
MD51151428bbe9c4db8494ee09e264d68c0
SHA1df4f43d116c401a1d8ac8875abd5a90b9cd04fde
SHA2564f0140ef91382f029c85c4325058d2f58c0df3d72e7857c6280f9d0bce14649a
SHA5126134d85a49c88d8029d8173b7a06d9ef2361fb9f8ec0aeb013d7452e0d40e162ba4c3f1deaefee3b2471dda1520f34c3241ab32e5ff812eeb0eaa524e78dc1a3
-
Filesize
4KB
MD5f81d4996f703358bd71dc26204f39638
SHA137ad311231a1df4e70ac7e8996c3c30702dbdf2f
SHA256cdbd3e9f8a9f8bbac2ca8b863296fb82660a64f3747a24b8ddee3a460c42ef30
SHA5125e421d9e186af7c64aaf4754d0e81da6383dfff52c239868595a139a808e3d01e89471cfdb0364b4d50506e33d21076fba73b1cd09a0320d34aeffc2bf9151e1
-
Filesize
129B
MD5822bda72f7eac8e3725e1d7c22fc6c73
SHA181c03da7b90b382cdd51385dde60ecc780bc7506
SHA25644ffe65aed721914751ff11fe662191825550443ae230f5600869389b3bbf3cf
SHA512c073cdcc15649b9d52cf56d2e9120d1cb45687c29ce4d0ae564ab967441c97906ef2fa4a6c7c0a623482da9b9d72c78f7e95d155dc4e3d38b79d3e6983551d3e
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB