Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-08-2024 02:39
General
-
Target
7ea6c337c7918f6dfccb08a61d551ff07c23ecd8586133599606ab58ba654fe2.exe
-
Size
153KB
-
MD5
96ddcabeb56d62a396856feb32e7fd12
-
SHA1
79c165dcffb896a5a8d2f1a9610647a15390c04b
-
SHA256
7ea6c337c7918f6dfccb08a61d551ff07c23ecd8586133599606ab58ba654fe2
-
SHA512
de1055444ea00b5c3185e751f46628affc316f69d168487f6487d54db8846fb3ba2778c58f3cbdc10a59d229dcd25125f698c17bb9b03c9027171e5b4a642dbf
-
SSDEEP
3072:PqJogYkcSNm9V7D4Q18kglivxyOqGLrhhyT:Pq2kc4m9tD4RkCivxtLr
Malware Config
Extracted
C:\Bd58xlPHe.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (637) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ea6c337c7918f6dfccb08a61d551ff07c23ecd8586133599606ab58ba654fe2.exe"C:\Users\Admin\AppData\Local\Temp\7ea6c337c7918f6dfccb08a61d551ff07c23ecd8586133599606ab58ba654fe2.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\E81F.tmp"C:\ProgramData\E81F.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E81F.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{8AA94998-FF12-48BB-8795-BB16A4B8159F}.xps" 1336945917234700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5823f31fcd2d9cf96c9afbe132c9b0e8d
SHA1f394eb7a345755d3003c6adcfb2477618ec6f3b2
SHA25631d3742fd4787b7188f1a9dcd37a98bc611a2ff6d3c5dce60abb46f712a4a088
SHA5129a666955f6b5783f9206044f83ce45011c85b27484954cb59be622a021396ca20b76ee8b6132c23a9bb278b23661bd5f9ec399235886fde7b9d055df6be0d640
-
Filesize
6KB
MD5d8d14ec352d17d40686e45520814fc9a
SHA1ea44259ff1e27a3ce4c625bff9ba72c226ca4ee8
SHA256103ee5322ab209caf24cec45b426975a77e0faf6ab34a0c851e3da9a442d7f4d
SHA512030d5144c7182ead90478534d0e1a5e8e51906058031c949a539b0f880afa52b09779cf545941ba2eee69b1f099c4edda9443b7f2b89494514eb4bf61b0bcec2
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
153KB
MD51658f19d2fb657ae73b3bc47524f7ee7
SHA1eca90030016e4def95b53922562178418824a86d
SHA25655b9d70074d0d9cb53eed1f6ff3b8df6dd2bd9cf6758da58e56bd568b3eb4872
SHA5122d673b6bfb724557f4d7f05fd0e28bca3a36e0faaed4e58b979cb6084d12a1164d12e24bf762c7f6196dd9889f208cb776e9e048170fea4fa577e6e3bbbf0f29
-
Filesize
4KB
MD56b04547801f4e020e7d66fc0a53cfb80
SHA149777c7a96223dc6797d9b6ad6f503f6a0c79d72
SHA25648b8d9760afa7744a7f7ad97e13295e1f189f6d38b6d1886475b5e19fc11dc58
SHA5124b9ff7b9243c05c33e59be3523f4fb911c3f1606d97dc4da516fc62fa6fd80d751ccdca2873ce81fedb3e07d796f0504f777c668f86e834d9be62ac85b484938
-
Filesize
4KB
MD506e979e8249b0e4848aafb6ffd479e7d
SHA10505c239e27f0f1b0ec990f8dcb9dda26022a662
SHA256995250437ffbe9a52ab9dfdcd2dc1b50d239e6e288c7f79e4fdeca53e6468693
SHA512741d57a2d931e75df75344cbe6ee7d82f5b097d3f1818447fc4ef4dcc7c3b3a2e4ad336c967fed065c8ed0867267fa59eb080872ec5858ee1a3f3eeaa17c1110
-
Filesize
129B
MD5096da659f63ae56579cf3e59eefa0616
SHA1e5fea0f2f9bd7efc4b971970a4c10b875a7f46f2
SHA256a0a8ad735f5dcd8d94d8ade2f773cdfa8adb69f6154684c119826952e2c2d25b
SHA5121da028ff601999f0b11c7058f843d02a065457e5e9c0e56c5b30510427d4bdfc7a09a913e5a30d6507895ff31250c044c70c9e457f9aa3baf0520f702a3a3327
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB