Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 12:40
Behavioral task
behavioral1
Sample
8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe
Resource
win10v2004-20241007-en
General
-
Target
8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe
-
Size
159KB
-
MD5
b7bc0b8b4cb9d004c6fc5412ed2b9191
-
SHA1
b2037b6b1b0c694ff42ff48b7d941b698af60795
-
SHA256
8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59
-
SHA512
77c2bf6afc5de3207d7b6324ce87e47459c29200e3df6377c5951039746f6486efc40e333c4fbb7796efa8933ebb59a22dd69e2c3f61f6bfce2545977e114034
-
SSDEEP
1536:/k624bGK+4yfw/OLY1SIrXV1bwyJckb5VfKCSLFbln/SfO0jG:s62GRKAOE0IrXVNwyJcS5Vfgbl/d0y
Malware Config
Extracted
C:\Users\HW9CMOgd5.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.HW9CMOgd5 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.HW9CMOgd5\ = "HW9CMOgd5" 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HW9CMOgd5\DefaultIcon 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HW9CMOgd5 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HW9CMOgd5\DefaultIcon\ = "C:\\ProgramData\\HW9CMOgd5.ico" 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeDebugPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: 36 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeImpersonatePrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeIncBasePriorityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeIncreaseQuotaPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: 33 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeManageVolumePrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeProfSingleProcessPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeRestorePrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSystemProfilePrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeTakeOwnershipPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeShutdownPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeDebugPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeBackupPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe Token: SeSecurityPrivilege 2496 8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe"C:\Users\Admin\AppData\Local\Temp\8b13802f1e7b60cbd1e0a120ec41dcdae659712b0cff79188c176c7a55e67e59.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:2840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55733ad52822c58c984f92f77999f0866
SHA19069492752a22dfe2630083e5498e51bd6f3d660
SHA25605da51a45f094ec58e407fa06fec35d7eaf7f5a6fa614015dd219db4e1b9e2b2
SHA51267d490d4dfb0280b49e11b63468a234c76fb1ee39e841203a8febdc437405e9b58d97c5cffee315b06424edf39e7b43dbf4dd6d9aa278f0b1a8be46a36dec9a6
-
Filesize
10KB
MD5a6c758b1ddc19a8d07363ada31af2261
SHA17a10f4b938cfd553c66fc560b2565de36f019b64
SHA256a12b1ba21cb8f857cabbcd39671e126785016bd47f450602ccddd57c1bd77b27
SHA5121abb0f0916f2da7e6412e42cb70a0d38d1e131a9f3fe5b99977392b48d8b30373bc3ba83efb5c1bcdde41c8401b0b4ac44828820009021a59004614dedf2b623
-
Filesize
129B
MD59b9dca17f73b4d7fa83331ff0c14749b
SHA17a57a557482bacf05a66a80ad70462451fa6458f
SHA256b640a3909117997e555ecc29c010bf83ee54e80d7cb1a94797d79666618391a2
SHA5129b70e615610018384535cfad8ec64b98c1f0854a0cedb7430eda5afd3444da5a897738262b825ed785f1cdbf29f3875830fc6a417268da54f37dda52d515fec8