Overview

overview

10

Static

static

1

F-Secure-S...er.exe

windows10-2004-x64

10

F-Secure-S...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 09:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    F-Secure-Safe-Network-Installer.exe

  • Size

    3.0MB

  • MD5

    9c15aac2f31dd9e1e8d64cf8f04ea5d6

  • SHA1

    aaeeb05a24f6e7ef77d46ba71794490afbc414ab

  • SHA256

    e082c6d30278139fdab5a7ddddecbcbafad12ab4dff1d5a960d9704fe635c007

  • SHA512

    0249416a9a1b526b887007704133166353fa97f9def8e57725092ee61f3bc0f5090238699c47733962495cd64550413acf25ff3086d1617e4440e9b6eba1a975

  • SSDEEP

    49152:+zk68h1xr/Rq09zUWUus6qidDQjvBJVSq2UCur80qDt5OXqj:+I6Q/Rq09zUWUus6qidE80qDt5OXqj

Score
10/10
lockbitdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\wlJ8FiR2h.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom DeathGrip Ransomware Attack | t.me/DeathGripRansomware This computer is attacked by russian ransomware community of professional black hat hackers. Your every single documents / details is now under observation of those hackers. If you want to get it back then you have to pay 1000$ for it. This Attack Is Done By Team RansomVerse You Can Find Us On Telegram @DeathGripRansomware Contact The Owner For The Decrypter Of This Ransomware #DeathGripMalware >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on Telegram t.me/DeathGripRansomware >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using on Telegram messenger without registration and text t.me/DeathGripRansomware Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
URLs

http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion

http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion

http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion

http://lockbitsupp.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Renames multiple (641) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\F-Secure-Safe-Network-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\F-Secure-Safe-Network-Installer.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\installer.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
        • Drops file in System32 directory
        PID:1840
      • C:\ProgramData\D9C7.tmp
        "C:\ProgramData\D9C7.tmp"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4172
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D9C7.tmp >> NUL
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3516
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:4512
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3568
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D3931566-EC13-46BE-9215-BB2C5AB70C90}.xps" 133692254450810000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4140

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\BBBBBBBBBBB
      Filesize

      129B

      MD5

      233a96aa25f7c2d1262bad1b4d4f558a

      SHA1

      6e896a611382aa3761122d2203e82029b62d3e4f

      SHA256

      3d4b63f6cf63f1304a8971addbef687fd2869a1d56f9b4b0402d4e69f9bb3160

      SHA512

      bd4043819b72a1fb6a03526699741699b6efe297bc0e5ec9c7f562dad5bee1be0582b4f0ffd8c71dc457fd127747efc60349fdebae0719a23e541c484f51abda

      Download Submit

    • C:\ProgramData\D9C7.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D3931566-EC13-46BE-9215-BB2C5AB70C90}.xps
      Filesize

      13.1MB

      MD5

      f70e52f2f0a7ff6866f1346126d640e2

      SHA1

      b20921b006fa3215938859fb9b1881fb61956c09

      SHA256

      aa61ac5d09cae0cbd21dbf7a65d577e47540c7edb9182844e430c9f96880ca73

      SHA512

      c06bc5c1ccb7ae7c9336e71977fb950a0025ce571d2c8be454f234672e0aaeba7cf086fd0c7fd4f23c81654d548ffcbebb74c62d9cc6271274e7538478402608

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEE
      Filesize

      150KB

      MD5

      8c9a63b7d3294ac0728133f2b975931d

      SHA1

      2a359415af38d1f71f59c4ed48a5d85669f5a609

      SHA256

      8c586fb154a92c9f83273b7f2cee649d26b1145b991aa8961b7b88bc57a9aac4

      SHA512

      9685ef85b2f1fe5cb44efb5de0f8ae22b4fc23b8a82a3b37d529c99dc5076de480ec4de936f482d4f0d25ee59e3e90d5c69c9d3a3e2062977974c98a1938f7c4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\installer.exe
      Filesize

      150KB

      MD5

      7e503c206e57f0295da017914a957d04

      SHA1

      96c375b9c57292db73c7ef2f2df16cf7be1604bb

      SHA256

      274844568a6a9ce334d71efeac21f528d7b54b2cd4377c978cc1270c6ad986c4

      SHA512

      cd4889ae107c54df854042e030eb431664d4db9d6dc908d1f1910ca49b89d247222f9d19440fcc2d9a120c95b56cd694750072ab9486eea961b8c33391344c1c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{3453B477-1304-4360-95BD-CFE2AB5B0AD7}
      Filesize

      4KB

      MD5

      0a54217b757c7566390b30d2c690bc01

      SHA1

      66b3b1fe5f68ed1b95430c0e21c8eb460aec3c23

      SHA256

      433e1e61ff2873346c9db2108e56d51d63e83041f6d3299efb3330f481de2a2e

      SHA512

      f66688282cc96b4531a98946379988461b4e9a26b9824efa6eaf31fa92c7bd979e4fef7b0e699b17daeaff6d6709b136bbcef3a7549850872de727f5534778c9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{CEC5C41B-2F2F-4018-A170-947812268BA2}
      Filesize

      4KB

      MD5

      d262e9f2de48766eeb7bdc9c02555817

      SHA1

      9023df8702129df8b9844760dc0c86042ffff984

      SHA256

      f820ce74897852a3f36ad809286909a8e15c59ea8eca4b2e3fd8e9af493cf711

      SHA512

      19fae1bace7bd51ace3ec5da7e1071cd44ee8e0eceff8c006d87b95d7ce2897c86fdbb24f2548c8189178dd7fecd53ca81d69f6754b1fc65453644c19f4c52d1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
      Filesize

      16B

      MD5

      d29962abc88624befc0135579ae485ec

      SHA1

      e40a6458296ec6a2427bcb280572d023a9862b31

      SHA256

      a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

      SHA512

      4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      35c62f7cab98217faac26ed0283116ce

      SHA1

      5c92c7a3a0d60fe3ac23280fb565b49b418c3d1c

      SHA256

      a8c26d8b3d754c561e0a88fd9fd8a1557ee70db8dd6422d593a3d8be16df1319

      SHA512

      b0f76ddeae770cc8a28e11a755b5bb4b2bb31a713c3608114110c8631b3e98e8ad95b8ec7c893138c14c87e71579fc400d32e41bec5ca958acaaf3e72426b440

      Download Submit

    • C:\Users\wlJ8FiR2h.README.txt
      Filesize

      3KB

      MD5

      b9674de0868a93e9121bdb1d02d80130

      SHA1

      79d692fd03d3110a4358e2cc7442af9517489f3f

      SHA256

      9268d24e96639cf4c0e8d74f9769092b415015692ea528820faaded6fc5b052c

      SHA512

      b3264ad33eddedb2c18da883e2345247c762adc8a604991fce931cba06b86c361d23fa121e79d6c69948a2d5b9c1613139f401b971360d9d684abb5a61543c02

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      7ea1e87a37478bfbd6a673a647353cf4

      SHA1

      f9d78617dcce62656af7d076c8e1503dbd94d350

      SHA256

      0d870912a1798204776485e29fd3b551c3800e37cae5724fa83e9989e8cbfef1

      SHA512

      5dc8484d778732efb7fcf9aa210de9868e71d44c56036ca0e226b58006acacb65b3e1e2ca381c82cd759c75d337211250acee4f641e8d1adb0f281b2ffff9974

      Download Submit

    • memory/1960-2985-0x00007FF683600000-0x00007FF683782000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1960-3036-0x00007FF683600000-0x00007FF683782000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/3052-17-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3052-15-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3052-16-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-2999-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3001-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-2998-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3000-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3034-0x00007FF9A0750000-0x00007FF9A0760000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-2997-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3035-0x00007FF9A0750000-0x00007FF9A0760000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3151-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3150-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3153-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4140-3152-0x00007FF9A2FF0000-0x00007FF9A3000000-memory.dmp

      Filesize

      64KB

      Download