Analysis
-
max time kernel
1561s -
max time network
1566s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6150.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
1800 seconds
Behavioral task
behavioral2
Sample
6150.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
1800 seconds
General
-
Target
6150.exe
-
Size
959KB
-
MD5
df7a9a45a10c1942225eb9be257fb752
-
SHA1
874630d6f4bdf9224125d35f30c48bc6d1da8ec1
-
SHA256
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f
-
SHA512
c812b5bfbba51b196954e0c14668e3b46b79db3c62848a8be4f96ef12105948e22e41949c5a62e661ddda0126900d5058cf641b3351fa4b0ce0a3e7fd2aecbe2
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdsF:Ujrc2So1Ff+B3k796e
Malware Config
Extracted
Path
C:\Program Files\Java\jdk1.7.0_80\include\Restore-My-Files.txt
Ransom Note
LockBit 2.0 Ransomware
Your data are stolen and encrypted
The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
You can contact us and decrypt one file for free on these TOR sites
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
OR
https://decoding.at
Decryption ID: F189D874E328CF93DA6FB39196C75692
URLs
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2444 bcdedit.exe 2304 bcdedit.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E7894974-2828-CFE0-79A7-7920B9D0E148} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6150.exe\"" 6150.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 6150.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\windows\SysWOW64\F189D8.ico 6150.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
pid Process 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files (x86)\microsoft office\media\cagcat10\j0300520.gif 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\pdir19f.gif 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\tools.jar 6150.exe File opened for modification C:\program files\windows sidebar\gadgets\rssfeeds.gadget\en-us\gadget.xml 6150.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\undocked_black_moon-first-quarter.png 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\bd09662_.wmf 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar 6150.exe File opened for modification C:\program files\java\jre7\lib\zi\america\indiana\petersburg 6150.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\144dpi\(144dpi)graystateicon.png 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\tab_on.gif 6150.exe File opened for modification C:\program files (x86)\microsoft office\templates\1033\originmergefax.dotx 6150.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\currency.gadget\icon.png 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar 6150.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\reader\tracker\rss.gif 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\toolbmps\dataviewiconimagesmask.bmp 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\toolbmps\spacebackupicons.jpg 6150.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\ja-jp\js\settings.js 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_cn.jar 6150.exe File opened for modification C:\program files\java\jre7\lib\zi\pacific\funafuti 6150.exe File created C:\program files\microsoft games\multiplayer\checkers\it-it\Restore-My-Files.txt 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0145212.jpg 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\tab_on.gif 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\deploy.jar 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar 6150.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\es-es\gadget.xml 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0384888.jpg 6150.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\flippage\pagecurl.png 6150.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\travel\passportmask_pal.wmv 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\mscss7wre_es.dub 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar 6150.exe File opened for modification C:\program files\java\jre7\lib\zi\america\dawson 6150.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd14985_.gif 6150.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\lines\bd21390_.gif 6150.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\babygirl\btn-back-static.png 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\argentina\catamarca 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\etc\gmt 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\etc\utc 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\pdir43b.gif 6150.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\images\diner_h.png 6150.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\24.png 6150.exe File created C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\Restore-My-Files.txt 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0099147.jpg 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\xlate_init.xsn 6150.exe File opened for modification C:\program files\7-zip\lang\ko.txt 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\hh00636_.wmf 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0382966.jpg 6150.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\theme fonts\essential.xml 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\header.gif 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\sy00170_.wmf 6150.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd15275_.gif 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\forms\1033\appt.cfg 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_left.gif 6150.exe File opened for modification C:\program files\7-zip\lang\it.txt 6150.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\resource\linguistics\providers\proximity\11.00\usa37.hyp 6150.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0195342.wmf 6150.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\slideshow.gadget\images\prev_hov.png 6150.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\vignette\navigationleft_buttongraphic.png 6150.exe File opened for modification C:\program files\java\jre7\lib\zi\america\guyana 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\background.gif 6150.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\push\navigationleft_buttongraphic.png 6150.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\autoshap\bd18194_.wmf 6150.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubftscm\scheme52.css 6150.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\pets\pets_frame-highlight.png 6150.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\mexico_city 6150.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2740 3044 WerFault.exe 27 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6150.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1432 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \Registry\Machine\Software\Classes\.lockbit 6150.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 6150.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F189D8.ico" 6150.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe 3044 6150.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3044 6150.exe Token: SeDebugPrivilege 3044 6150.exe Token: SeBackupPrivilege 1824 vssvc.exe Token: SeRestorePrivilege 1824 vssvc.exe Token: SeAuditPrivilege 1824 vssvc.exe Token: SeIncreaseQuotaPrivilege 1648 WMIC.exe Token: SeSecurityPrivilege 1648 WMIC.exe Token: SeTakeOwnershipPrivilege 1648 WMIC.exe Token: SeLoadDriverPrivilege 1648 WMIC.exe Token: SeSystemProfilePrivilege 1648 WMIC.exe Token: SeSystemtimePrivilege 1648 WMIC.exe Token: SeProfSingleProcessPrivilege 1648 WMIC.exe Token: SeIncBasePriorityPrivilege 1648 WMIC.exe Token: SeCreatePagefilePrivilege 1648 WMIC.exe Token: SeBackupPrivilege 1648 WMIC.exe Token: SeRestorePrivilege 1648 WMIC.exe Token: SeShutdownPrivilege 1648 WMIC.exe Token: SeDebugPrivilege 1648 WMIC.exe Token: SeSystemEnvironmentPrivilege 1648 WMIC.exe Token: SeRemoteShutdownPrivilege 1648 WMIC.exe Token: SeUndockPrivilege 1648 WMIC.exe Token: SeManageVolumePrivilege 1648 WMIC.exe Token: 33 1648 WMIC.exe Token: 34 1648 WMIC.exe Token: 35 1648 WMIC.exe Token: SeIncreaseQuotaPrivilege 1648 WMIC.exe Token: SeSecurityPrivilege 1648 WMIC.exe Token: SeTakeOwnershipPrivilege 1648 WMIC.exe Token: SeLoadDriverPrivilege 1648 WMIC.exe Token: SeSystemProfilePrivilege 1648 WMIC.exe Token: SeSystemtimePrivilege 1648 WMIC.exe Token: SeProfSingleProcessPrivilege 1648 WMIC.exe Token: SeIncBasePriorityPrivilege 1648 WMIC.exe Token: SeCreatePagefilePrivilege 1648 WMIC.exe Token: SeBackupPrivilege 1648 WMIC.exe Token: SeRestorePrivilege 1648 WMIC.exe Token: SeShutdownPrivilege 1648 WMIC.exe Token: SeDebugPrivilege 1648 WMIC.exe Token: SeSystemEnvironmentPrivilege 1648 WMIC.exe Token: SeRemoteShutdownPrivilege 1648 WMIC.exe Token: SeUndockPrivilege 1648 WMIC.exe Token: SeManageVolumePrivilege 1648 WMIC.exe Token: 33 1648 WMIC.exe Token: 34 1648 WMIC.exe Token: 35 1648 WMIC.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3008 3044 6150.exe 28 PID 3044 wrote to memory of 3008 3044 6150.exe 28 PID 3044 wrote to memory of 3008 3044 6150.exe 28 PID 3044 wrote to memory of 3008 3044 6150.exe 28 PID 3008 wrote to memory of 1432 3008 cmd.exe 30 PID 3008 wrote to memory of 1432 3008 cmd.exe 30 PID 3008 wrote to memory of 1432 3008 cmd.exe 30 PID 3008 wrote to memory of 1648 3008 cmd.exe 34 PID 3008 wrote to memory of 1648 3008 cmd.exe 34 PID 3008 wrote to memory of 1648 3008 cmd.exe 34 PID 3008 wrote to memory of 2444 3008 cmd.exe 36 PID 3008 wrote to memory of 2444 3008 cmd.exe 36 PID 3008 wrote to memory of 2444 3008 cmd.exe 36 PID 3008 wrote to memory of 2304 3008 cmd.exe 37 PID 3008 wrote to memory of 2304 3008 cmd.exe 37 PID 3008 wrote to memory of 2304 3008 cmd.exe 37 PID 3044 wrote to memory of 2740 3044 6150.exe 42 PID 3044 wrote to memory of 2740 3044 6150.exe 42 PID 3044 wrote to memory of 2740 3044 6150.exe 42 PID 3044 wrote to memory of 2740 3044 6150.exe 42 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6150.exe"C:\Users\Admin\AppData\Local\Temp\6150.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1432
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2444
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2304
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 48482⤵
- Program crash
PID:2740
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1876
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD51ed95ea6d6dea9888d1a0669a566b84d
SHA1c8c874f20201a2893effb85165a40a445f2b3b65
SHA256f1cba7ac4ce53ab5b45d723c600a8fd19a43913c375022ad1608d4ab0a2c2f6d
SHA51201b04149bc806dfc1686b0d4b8792cba944e412d3a6c3d7d82af1191d89fa75ea58ecf7a8ee398c2b64c65ed0dab91c8ac458508a55725d7a3be248c7b0b4c42