Overview

overview

10

Static

static

3

2168eec449...1N.exe

windows7-x64

10

2168eec449...1N.exe

windows10-2004-x64

10

Resubmissions

19-01-2025 12:12

250119-pdcxxawqfs 10

10-01-2025 21:31

250110-1c46js1kdm 10

Analysis

  • max time kernel
    81s
  • max time network
    77s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2025 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2168eec449ce9f9b81422baf16168ae7dea718c323d1fc4e606bd28930379f41N.exe

  • Size

    959KB

  • MD5

    d305531e1c4e5a47314783e97a55c180

  • SHA1

    485921a1b06654f63f0a0a6617fa1e13ca66075f

  • SHA256

    2168eec449ce9f9b81422baf16168ae7dea718c323d1fc4e606bd28930379f41

  • SHA512

    0e8dd9a5af2fca82cd032ef36d6b7f8ae309562962fce211c708675facddc3c9d828d74efaaa47bd247b1415895d37b122a59b280cbb9cd4f0a07b18b06ee1fe

  • SSDEEP

    24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpd4F:Ujrc2So1Ff+B3k796C

Score
10/10
lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\dotnet\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: AE503BEC2C0987EC8CBB97C2839CD416
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Users\Admin\Desktop\LockBit_Ransomware.hta

Ransom Note
Any attempts to restore your files with the thrid-party software will be fatal for your files! To recovery your data and not to allow data leakage, it is possible only through purchase of a private key from us There is only one way to get your files back: Through a standard browser Brave (supports Tor links) FireFox Chrome Edge Opera Open link - https://decoding.at/ Through a Tor Browser - recommended Download Tor Browser - https://www.torproject.org/ and install it. Open one of links in Tor browser and follow instructions on these pages: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or mirrorhttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion/These links work only in the Tor browser! Follow the instructions on this page https://decoding.at may be blocked. We recommend using a Tor browser (or Brave) to access the TOR site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about All your stolen important data will be loaded into our blog if you do not pay ransom. Our blog http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion or https://bigblog.at where you can see data of the companies which refused to pay ransom.
URLs

https://decoding.at/

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or

https://decoding.at

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 16 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2168eec449ce9f9b81422baf16168ae7dea718c323d1fc4e606bd28930379f41N.exe
    "C:\Users\Admin\AppData\Local\Temp\2168eec449ce9f9b81422baf16168ae7dea718c323d1fc4e606bd28930379f41N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:440
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4372
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3408
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4244
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3144
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 1688
        3⤵
        • Program crash
        PID:4244
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2168eec449ce9f9b81422baf16168ae7dea718c323d1fc4e606bd28930379f41N.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2168eec449ce9f9b81422baf16168ae7dea718c323d1fc4e606bd28930379f41N.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.7 -n 3
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4540
      • C:\Windows\SysWOW64\fsutil.exe
        fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\2168eec449ce9f9b81422baf16168ae7dea718c323d1fc4e606bd28930379f41N.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1472
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2396
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\moverepair.xlsx.lockbit
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:3644
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore-My-Files.txt
    1⤵
      PID:3132
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore-My-Files.txt
      1⤵
        PID:4216
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore-My-Files.txt
        1⤵
          PID:4352
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4008 -ip 4008
          1⤵
            PID:1896
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore-My-Files.txt
            1⤵
              PID:3856
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore-My-Files.txt
              1⤵
                PID:3764
              • C:\Windows\system32\mshta.exe
                "C:\Windows\system32\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta"
                1⤵
                  PID:4432
                • C:\Windows\system32\mshta.exe
                  "C:\Windows\system32\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta"
                  1⤵
                    PID:2840
                  • C:\Windows\system32\mshta.exe
                    "C:\Windows\system32\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta"
                    1⤵
                      PID:2872
                    • C:\Windows\system32\mshta.exe
                      "C:\Windows\system32\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta"
                      1⤵
                        PID:224

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Windows Management Instrumentation

                      1
                      T1047

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Direct Volume Access

                      1
                      T1006

                      Indicator Removal

                      2
                      T1070

                      File Deletion

                      2
                      T1070.004

                      Modify Registry

                      2
                      T1112

                      Credential Access

                      Discovery

                      Network Service Discovery

                      1
                      T1046

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      2
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Defacement

                      1
                      T1491

                      Inhibit System Recovery

                      3
                      T1490

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files\dotnet\Restore-My-Files.txt
                        Filesize

                        512B

                        MD5

                        e9229ab6afe7b7d3f04b8876d387220e

                        SHA1

                        0eea2e7020ec4cb2755fa54fe6d142f71adac591

                        SHA256

                        9bc71bf0a46a5bf2ec86c46294b72a9dd5fe5d399325ec63b7da345214c6cc7d

                        SHA512

                        f45ad08448591ffe020f4e303c5ca087e048fcd23b8371f94d7ce363612e9081d80268665556078553f607e3cf15393afc65f99453a5a8dbc75e4974046396bb

                        Download Submit

                      • C:\Users\Admin\Desktop\LockBit_Ransomware.hta
                        Filesize

                        46KB

                        MD5

                        c15c6adc8c923ad87981f289025c37b2

                        SHA1

                        bfe6533f4afe3255046f7178f289a4c75ad89e76

                        SHA256

                        90f3a33919fdd766e90fd96f8f20a92c2d1376b7cfdc8b738c2f8e7e6c7498b1

                        SHA512

                        31dd03b208e00ac012fbe4189d5af1306cc8e3640d40efefab4aa1cabab3c4735eef0cb65e7750c3c77021934e145398e5e26389975cf36b193c8f622a5fde83

                        Download Submit

                      • C:\Users\Admin\Desktop\moverepair.xlsx.lockbit
                        Filesize

                        13KB

                        MD5

                        42b9799a39bd4848ac6200be54df5ba4

                        SHA1

                        4a9aac8af982333dae6f124dfdc12211b478052e

                        SHA256

                        6b1b5b014ad595c798873437e42c4f35de9534c9a61747d2bc8563847c69deb0

                        SHA512

                        07d1851ac41f4219f43cdf5c712a917d79d2e7acd7aac258cfeb36b8bf5be0a526b3e8e05534ee3daed1f42721ffc0cc7919e0ed1f72d242cbc86af97d3d8e88

                        Download Submit