Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

43ced481e0...e4.exe

windows7-x64

10

43ced481e0...e4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2025, 07:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe

  • Size

    174KB

  • MD5

    7f0312a1f928c3aeab672ca8d5afc6a9

  • SHA1

    efb367a61cb29e63a7269765c6071005a643a55d

  • SHA256

    43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4

  • SHA512

    854592111580d11597824a16b2d62ad313cf4ecdd2329cd9b333f2e3185f4cd21b16164f2e2330e3c5ecf5184471266528fa38d059920b900a32528f40bebcf6

  • SSDEEP

    3072:+yvWCxfzdNRvpEAdS3rDkALwlYu8+IFMyXJVlRGa5JJ5SU:NvWCxfz0gS7oczu8+IdXJVvbSU

Score
10/10
lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\dotnet\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?85C01E35FD24495CA4B56D102AC25364 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?85C01E35FD24495CA4B56D102AC25364 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?85C01E35FD24495CA4B56D102AC25364

http://lockbitks2tvnmwk.onion/?85C01E35FD24495CA4B56D102AC25364

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note
Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?85C01E35FD24495CA4B56D102AC25364 Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?85C01E35FD24495CA4B56D102AC25364 This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?85C01E35FD24495CA4B56D102AC25364

http://lockbitks2tvnmwk.onion/?85C01E35FD24495CA4B56D102AC25364

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (6406) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe
    "C:\Users\Admin\AppData\Local\Temp\43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3152
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4748
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1080
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4592
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:1708
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1208
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1780
        3⤵
        • Program crash
        PID:5236
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5588
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.7 -n 3
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1964
      • C:\Windows\SysWOW64\fsutil.exe
        fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 572
      2⤵
      • Program crash
      PID:5232
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3724
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:396
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:912
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1888
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2680 -ip 2680
      1⤵
        PID:5292
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1208 -ip 1208
        1⤵
          PID:5484

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Direct Volume Access

        1
        T1006

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        2
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        4
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Defacement

        1
        T1491

        Inhibit System Recovery

        4
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\dotnet\Restore-My-Files.txt
          Filesize

          1KB

          MD5

          7de3497fa02b44c3c0060ca8675249a2

          SHA1

          26e24afb89635ab4f1ae68e01dc0773f849eaf53

          SHA256

          0b7969ecd7938228ea432f2eb998daea432e693628b4779f936ccb27d6fae68c

          SHA512

          26e36f5fc75bdf5d4350e807c5ec92ba4940ec30aee45a623b651a8cefebefc98270c24c3ff63e90d996dcb389daaa9b25b9e6bd55b163aeaed4e0a6536ceaec

          Download Submit

        • C:\Users\Admin\Desktop\LockBit-note.hta
          Filesize

          17KB

          MD5

          f7f99708f848bd5381989fa3f3b96aef

          SHA1

          85a7b72b22a4a59f96af7a7278a11f676e060ba9

          SHA256

          8220dc4eac33adba7da4b319506223da227514f26e3f7d9c1731cef30b001715

          SHA512

          8e41b8d1f3901eed194d79ccc78c7cab98a072e4ee52bae01900c4f1b9804ba53677147e11d5a0576600610230d7f608c7bf8c908789d78d34308747427491b9

          Download Submit

        • memory/2680-3624-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2680-3716-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2680-3527-0x0000000000A70000-0x0000000000B70000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2680-3547-0x0000000000A30000-0x0000000000A56000-memory.dmp

          Filesize

          152KB

          Download

        • memory/2680-3546-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2680-3548-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

          Download

        • memory/2680-1-0x0000000000A70000-0x0000000000B70000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2680-3-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

          Download

        • memory/2680-3783-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2680-3814-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2680-3842-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2680-7786-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2680-2-0x0000000000A30000-0x0000000000A56000-memory.dmp

          Filesize

          152KB

          Download

        • memory/2680-8171-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

          Download

        • memory/2680-8170-0x0000000000400000-0x00000000008CB000-memory.dmp

          Filesize

          4.8MB

          Download