Overview
overview
10Static
static
10Lockbit-Ra...er.exe
windows7-x64
9Lockbit-Ra...er.exe
windows10-2004-x64
9Lockbit-Ra...er.exe
windows7-x64
9Lockbit-Ra...er.exe
windows10-2004-x64
9Lockbit-Ra...en.exe
windows7-x64
9Lockbit-Ra...en.exe
windows10-2004-x64
9Lockbit-Ra...ME.vbs
windows7-x64
1Lockbit-Ra...ME.vbs
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2024 14:51
Behavioral task
behavioral1
Sample
Lockbit-Ransomware-Builder-main/Builder.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
Lockbit-Ransomware-Builder-main/Builder.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Lockbit-Ransomware-Builder-main/Decrypter.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
Lockbit-Ransomware-Builder-main/Decrypter.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Lockbit-Ransomware-Builder-main/KeyGen.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Lockbit-Ransomware-Builder-main/KeyGen.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Lockbit-Ransomware-Builder-main/README.vbs
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Lockbit-Ransomware-Builder-main/README.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Lockbit-Ransomware-Builder-main/KeyGen.exe
-
Size
146KB
-
MD5
39c9477cf131ca5ccc05c8871c0e10e6
-
SHA1
07b2581b2cb41053d09c4bb896aaabc1d28f2a7b
-
SHA256
939281eac1c6e5aa2e4238a1e545e67b2609c15f517474b2a5133bb64fe9c1eb
-
SHA512
689fd585232031f746b1573d3ed66ac329420611d4e1092ce6952b49ab0c168091726bd02189a4e183d1196ced4f51953e4eb25a5219a36f86d8f6761da9f129
-
SSDEEP
1536:xzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDqk3sA9atm8z+L8QBfuSoyAMjwT:KqJogYkcSNm9V7D7352v+L8DnyAewT
Malware Config
Signatures
-
Renames multiple (620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation AE04.tmp -
Deletes itself 1 IoCs
pid Process 5640 AE04.tmp -
Executes dropped EXE 1 IoCs
pid Process 5640 AE04.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini KeyGen.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini KeyGen.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP2582fzna0gfz8mb_j59sj4agb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPcl30617bd2u2vj91dd7fgqp4b.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP5ht4bz894ce9u610mrljik7r.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1pvSvxmZY.bmp" KeyGen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1pvSvxmZY.bmp" KeyGen.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5640 AE04.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeyGen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop KeyGen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallpaperStyle = "10" KeyGen.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1pvSvxmZY KeyGen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1pvSvxmZY\ = "1pvSvxmZY" KeyGen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1pvSvxmZY\DefaultIcon KeyGen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1pvSvxmZY KeyGen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\1pvSvxmZY\DefaultIcon\ = "C:\\ProgramData\\1pvSvxmZY.ico" KeyGen.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe 4776 KeyGen.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp 5640 AE04.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeDebugPrivilege 4776 KeyGen.exe Token: 36 4776 KeyGen.exe Token: SeImpersonatePrivilege 4776 KeyGen.exe Token: SeIncBasePriorityPrivilege 4776 KeyGen.exe Token: SeIncreaseQuotaPrivilege 4776 KeyGen.exe Token: 33 4776 KeyGen.exe Token: SeManageVolumePrivilege 4776 KeyGen.exe Token: SeProfSingleProcessPrivilege 4776 KeyGen.exe Token: SeRestorePrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSystemProfilePrivilege 4776 KeyGen.exe Token: SeTakeOwnershipPrivilege 4776 KeyGen.exe Token: SeShutdownPrivilege 4776 KeyGen.exe Token: SeDebugPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeBackupPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe Token: SeSecurityPrivilege 4776 KeyGen.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE 5544 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4776 wrote to memory of 1800 4776 KeyGen.exe 92 PID 4776 wrote to memory of 1800 4776 KeyGen.exe 92 PID 5304 wrote to memory of 5544 5304 printfilterpipelinesvc.exe 99 PID 5304 wrote to memory of 5544 5304 printfilterpipelinesvc.exe 99 PID 4776 wrote to memory of 5640 4776 KeyGen.exe 100 PID 4776 wrote to memory of 5640 4776 KeyGen.exe 100 PID 4776 wrote to memory of 5640 4776 KeyGen.exe 100 PID 4776 wrote to memory of 5640 4776 KeyGen.exe 100 PID 5640 wrote to memory of 5276 5640 AE04.tmp 102 PID 5640 wrote to memory of 5276 5640 AE04.tmp 102 PID 5640 wrote to memory of 5276 5640 AE04.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lockbit-Ransomware-Builder-main\KeyGen.exe"C:\Users\Admin\AppData\Local\Temp\Lockbit-Ransomware-Builder-main\KeyGen.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1800
-
-
C:\ProgramData\AE04.tmp"C:\ProgramData\AE04.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AE04.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:5276
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4228
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{529CFAA1-8CA7-4BCF-A9A5-C4E82C3F0A28}.xps" 1337710628409400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5b5c4dc63721985816f24a69639bade52
SHA1192259959ca8096fb2390b2e0f43f64984e01bac
SHA256647fd48d340613c91bcfd1c1cf1bf2bb8c05133a44c1134e40a4db51d8d82946
SHA512f7344c0f2cb4a43b09e689123229118020202f639de718fed9b57a7d65e6cedf0498322a409a4e21fd551d3a9690d1a297d4f99050f1ce97c0edcc3e5e29bf38
-
Filesize
348B
MD59810eed5ecd966874ebeb398ac6531ed
SHA117d2e2bc15df652734b79185cb323e652559fd6a
SHA25653183e5ed0cf42bed46b17c9dcc92ea49737bb57dce34f1e20675a913796566e
SHA512b26ca61461ed8b09f037e33d209cd0a22959b89e3e7895e057f544010fd5ae037e4fa76311763c121cd6e8b3050de22fa7d2163b4d9cf40585e14f5024e0cb79
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD528c7522d735d8d6f27406355a1343b9c
SHA1e41bd6263bc47f2a0d316de1efabf4f248244ae2
SHA256a212445443220238e7f11e6e321a2b5d83b3f7d8d8c271b3b0f230c853a05d0b
SHA512315a1616fc359caabaa51ff13bdcc45d915a5437d319d1d20c3afb875a793273b3da8ce3dc44c12edd2d61d5d1a4a08a4deb53c39c0fc04e1f6e6b96ad6bcaa8
-
Filesize
4KB
MD5496558b85105f5333311c57a563f3d84
SHA16543a9893999ec7b9d32f2811b643ecb5a124671
SHA2563ee2f3b46676fc86e344e4081e3848b1add41758d10fe5de1de4e3ac3de5d0c7
SHA5124109f56d888e422188d4cdb68921090bd4440e7f0a1f51adfb12c042d2bf17c8b21f410714ae67830262ac209bf051f28737fe20ab200df5c7bf3dde63c4d9fc
-
Filesize
4KB
MD57f7ba331f4f6c33c7250e5a23e3dd96e
SHA1826c139d963006f1a73818c380cea37e2bd931bf
SHA2569165b8c06d09a336cbec9307280911fceb7a92b7c436f8ccf3355d446dfa7e90
SHA512b2910d25425f15c6018102698173b0fbbd23e98ec741968908d4a8e70241a3f4824463b01681ddba928284cbdf1f78b9e08bfdacb875d157f61cf2fc05a0cb9e
-
Filesize
129B
MD5f737369365ceffb0d796302c9d769b0a
SHA1516c5f023a44a1250af29a04891fe8d61cbdefd0
SHA2569b63d9903d5a689128a6f16a590fe3b286ffba807ebcfd77fddee7124e88236c
SHA5126e1561dcbd1f4160493bdb5836bed322473d42bfdde9bceba237ab855e1eb40b860bc608bdb2cd85287abdc6c8bcb5b50e69084b9843612c744556ba2e65127e