Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 13:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe
-
Size
136KB
-
MD5
02eaf054d741c5cdf530c6bb917dd762
-
SHA1
db68ff91ff5c5db354bf7dc20614590058f49ab0
-
SHA256
e05e3af5b9fe30f9efb2e719d797612b511b6c603060af9a55127375f1076ee3
-
SHA512
d98976dca558269a9e50a057e8e108cf78aeff2f73e875f9a3570264cbd43246227949811585a0467b481a3a6ebdf85278888cee57541a36067dbe68abe43696
-
SSDEEP
1536:Vf/zuJmTn2lvpSzyOvBWg8g3xeevKE2j5uQHd:pzHTn2lvpfg8g3xeevKE2j5uod
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe -
Executes dropped EXE 1 IoCs
pid Process 4180 PackagedCWALauncher.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NGEN5853_32 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NGEN5853_32\ = "Service" 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\ProgramData\Microsoft\v2.0_2.0.0.0__35a050ecd74d48ec\PackagedCWALauncher.exe:Zone.Identifier 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PackagedCWALauncher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4468 cmd.exe 4604 PING.EXE -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\v2.0_2.0.0.0__35a050ecd74d48ec\PackagedCWALauncher.exe:Zone.Identifier 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4604 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe 4180 PackagedCWALauncher.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2784 wrote to memory of 4468 2784 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe 90 PID 2784 wrote to memory of 4468 2784 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe 90 PID 2784 wrote to memory of 4468 2784 2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe 90 PID 4468 wrote to memory of 4604 4468 cmd.exe 92 PID 4468 wrote to memory of 4604 4468 cmd.exe 92 PID 4468 wrote to memory of 4604 4468 cmd.exe 92 PID 4468 wrote to memory of 1348 4468 cmd.exe 93 PID 4468 wrote to memory of 1348 4468 cmd.exe 93 PID 4468 wrote to memory of 1348 4468 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe"1⤵
- Checks computer location settings
- Impair Defenses: Safe Mode Boot
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe" & del "C:\Users\Admin\AppData\Local\Temp\2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe" > NUL & exit2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4604
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setzerodata offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2024-09-21_02eaf054d741c5cdf530c6bb917dd762_lockbit.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1348
-
-
-
C:\ProgramData\Microsoft\v2.0_2.0.0.0__35a050ecd74d48ec\PackagedCWALauncher.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__35a050ecd74d48ec\PackagedCWALauncher.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4180
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Safe Mode Boot
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD502eaf054d741c5cdf530c6bb917dd762
SHA1db68ff91ff5c5db354bf7dc20614590058f49ab0
SHA256e05e3af5b9fe30f9efb2e719d797612b511b6c603060af9a55127375f1076ee3
SHA512d98976dca558269a9e50a057e8e108cf78aeff2f73e875f9a3570264cbd43246227949811585a0467b481a3a6ebdf85278888cee57541a36067dbe68abe43696