lockbit

General

Target

https://www.swisstransfer.com/d/b66c3f0b-8bc4-473e-91c3-658bb53b5026
Sample

240928-xc8bestcjg

Score

10^/10

Malware Config

Targets

- Target
  
  https://www.swisstransfer.com/d/b66c3f0b-8bc4-473e-91c3-658bb53b5026
Score

10^/10

lockbit defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer upx
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Rule to detect Lockbit 3.0 ransomware Windows payload
- Renames multiple (687) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1