Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

7d98972d5c...9c.exe

windows10-2004-x64

9

7d98972d5c...9c.exe

windows7-x64

9

7d98972d5c...9c.exe

windows10-2004-x64

9

7d98972d5c...9c.exe

windows10-ltsc_2021-x64

9

7d98972d5c...9c.exe

windows11-21h2-x64

9

87b9b910d5...cb.exe

windows10-ltsc_2021-x64

10

87b9b910d5...cb.exe

windows7-x64

10

87b9b910d5...cb.exe

windows10-2004-x64

10

87b9b910d5...cb.exe

windows10-ltsc_2021-x64

10

87b9b910d5...cb.exe

windows11-21h2-x64

10

8958d7b8c5...e2.exe

windows10-ltsc_2021-x64

10

8958d7b8c5...e2.exe

windows7-x64

10

8958d7b8c5...e2.exe

windows10-2004-x64

10

8958d7b8c5...e2.exe

windows10-ltsc_2021-x64

10

8958d7b8c5...e2.exe

windows11-21h2-x64

10

ab5be9e691...09.exe

windows10-ltsc_2021-x64

10

ab5be9e691...09.exe

windows7-x64

10

ab5be9e691...09.exe

windows10-2004-x64

10

ab5be9e691...09.exe

windows10-ltsc_2021-x64

10

ab5be9e691...09.exe

windows11-21h2-x64

10

b228a698ee...c0.exe

windows11-21h2-x64

b228a698ee...c0.exe

windows7-x64

b228a698ee...c0.exe

windows10-2004-x64

b228a698ee...c0.exe

windows10-ltsc_2021-x64

b228a698ee...c0.exe

windows11-21h2-x64

c864a70f78...1d.exe

windows10-ltsc_2021-x64

c864a70f78...1d.exe

windows7-x64

c864a70f78...1d.exe

windows10-2004-x64

c864a70f78...1d.exe

windows10-ltsc_2021-x64

c864a70f78...1d.exe

windows11-21h2-x64

Resubmissions

25/03/2025, 13:12

250325-qfl42aznw9 10

25/03/2025, 13:09

250325-qdtq4aznv6 10

25/03/2025, 13:05

250325-qbtcjszns3 10

25/03/2025, 13:01

250325-p9k86awxat 10

25/03/2025, 12:55

250325-p58tnawwe1 10

25/03/2025, 12:51

250325-p3txqazmt6 10

05/02/2025, 11:16

250205-ndjvsavrdm 10

16/07/2024, 08:54

240716-kt64gavakp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    533.7z

  • Size

    2.7MB

  • Sample

    250325-qbtcjszns3

  • MD5

    7aded2388d27c5dc782dca435f160857

  • SHA1

    744f53fe1f4c7a43a82e1a942eb71f4175da8935

  • SHA256

    3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d

  • SHA512

    518957e9248e65c5231e10c3977d01f7d3b4aa43f08b00c668be8501a88e06d1eaa2a5aaf976ab9caa1d2eacbc7a2029731d5a7054df230aaf93a79294d9083b

  • SSDEEP

    49152:BdRLSYLgm9h2iT/1Xd6STMtS07Cqjgfzj8flramouva2dd1ALRNyndSBSJQIQV:BdNtJPDJXd62MY50R+a5X1my8BSJQzV

Score
10/10
blackmatterchaosdharmagandcrablockbitmakopmimicmodiloadernefilim512478c08dada2af19e49808fbda5b0bcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Family

blackmatter

Version

1.2

Botnet

512478c08dada2af19e49808fbda5b0b

Credentials
C2

https://paymenthacks.com

http://paymenthacks.com

https://mojobiden.com

http://mojobiden.com
Attributes
  • attempt_auth

    true

  • create_mutex

    true

  • encrypt_network_shares

    true

  • exfiltrate

    true

  • mount_volumes

    true

rsa_pubkey.base64
aes.base64

Extracted

Path

C:\PerfLogs\How To Restore Your Files.txt

Ransom Note
----------- [ Hello! ] -------------> ******BY ANUBIZ LOCKER****** What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. How to contact us? ---------------------------------------------- Using EMAIL: 1) Open your mail 2) Write this ID in the title of your message: kFdfAV0C4B 3) Write us: [email protected] !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!

Extracted

Path

C:\Program Files\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: D89C6F255199BB9E6B3A6D3617E1A9C2
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Users\Admin\Desktop\LockBit_Ransomware.hta

Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="x-ua-compatible" content="ie=9" /><title>LockBit</title><hta:application id=LockBit applicationName=LockBit selection=no scroll=no contextmenu=no innerBorder=no windowState=maximize minimizeButton=no singleInstance=yes sysMenu=no /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><style>html{font-size:100%}body{position:relative;border:0;font-family:Arial;padding:1% 0 0;margin:0;width:100vw;height:100vh;overflow:hidden}*{font-size:1rem}.g1{content:"";position:absolute;left:0;top:50%;transform:translateY(-50%);height:368px;width:150px;z-index:-1}.g2{z-index:-1;content:"";position:absolute;right:0;top:50%;transform:translateY(-50%);height:368px;width:150px}.container{width:90%;margin:auto}.container img{max-width:100%}.ht{margin-bottom:1%;position:relative;padding-left:16px;font-weight:900;font-size:1rem;line-height:100%;letter-spacing:.05em;text-transform:uppercase;color:#dedede}.hb{margin-bottom:1%}.hb img{width:850px;max-width:100%}.hi{margin-bottom:1rem;background:#fcfcfd;border:1px dashed #f71b3a;box-sizing:border-box;border-radius:4px;padding:1rem 3rem;width:100%}.hit{margin-bottom:1%;font-weight:700;font-size:.9rem;line-height:100%;color:#222}.hib{font-weight:700;font-size:.9rem;line-height:100%;color:#f71b3a}.main-p{font-weight:700;font-size:1rem;line-height:125%;color:#333160}.mn{position:absolute;width:5%;height:276px;top:3rem}.mn img{max-width:90%}.ml1{position:absolute;width:50%;height:10rem;left:0;top:0;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2%}.ml2{position:absolute;width:50%;height:13rem;left:0;top:11rem;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2%}.mr3{position:absolute;padding:2%;width:48%;height:24rem;left:52%;top:0;background:#ffdfdf;border:1px solid #ffa5aa;box-sizing:border-box;border-radius:4px;font-size:15px;line-height:130%}.mlb{font-size:.8rem;line-height:1.2;color:#8988a4;margin-top:2%;margin-bottom:2%}.mlb img{max-width:14px}.sp1{left:0;top:50%;position:absolute;display:block;width:6px;height:6px;background:#f71b3a;transform:translateY(-50%) rotate(135deg)}.mll{font-size:.9rem;line-height:1.2;color:#333160;margin-bottom:2%;position:relative;padding-left:20px}.mll a{font-size:.8rem}.mlt{margin-bottom:15px;font-weight:700;font-size:.9rem;line-height:1.2;color:#333160}.mlt img{max-width:14px;position:relative}.mrli{font-size:.9rem;line-height:1.2;margin-bottom:2%;position:relative;padding-left:25px;color:#222}.mrli a{font-size:.9rem}</style><script type="text/javascript">function o(c){var d=new ActiveXObject("WScript.Shell");d.run(c.href)};</script></head><body bgcolor="#F8F8F8" text="buttontext"><img class="g1" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJYAAAFwAQMAAABgpRCKAAAABlBMVEXw8PDv7+81SmF7AAAAAXRSTlMBN+Ho8AAAAWpJREFUeAHt1slxBCEMhWFRs3AkhA7BIRAahEYIDoEQOM5CIfvOX2V5nwWOX+8t6RWirzIt1QamGayDaQY7gSlZBTuBKVkBO4ENMM1gFayBdTAly2AV7ATWwQaYZrACVsFOYB1sgClZBitgDewE1sGG0ZSsGK2CNbATWP/YDC/t6K9uYDsqe4Kyb/Pflx0Y9mUEC9CrHnrVgeHgRLANhimA+fkniAPDaU9gERJgI4PoCWAe0mMH5sAgytgSWIQMJdvIIC6D0TwZFGRnNEcGhSOT71iai/4ti39mJyim9bxly27TdFpkFayBnYzWly1btuxH7AVMElgAc2CSwCJYAPNgDkzIElgE24wWwLzRdkZzRpPvWFom+rPmjLYzmjda+EY/R7AEZpxBDxZuyPyN2+7Gzd2hya1buiFTmzmwHZgHiw+8l1q27PTD1r5h1WjFaBlMZhtG62AnsAZWwDKYzNbBGliZbchs9Z3eAJcyeuremDsyAAAAAElFTkSuQmCC" /><img class="g2" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJYAAAFwAQMAAABgpRCKAAAABlBMVEXv7+/w8PB6KHGJAAAAAnRSTlP/AZKwANwAAAGJSURBVHgB7dSHbQMhFMbxh1xQZwQWyA6MdozGCBmBEVB3QRApF3wk77P80l34q/+uH4Xqx56JWSRmO+LmuSXi5rll4haBEbcMLAEL3Apx2wFLwAIw4paB7YBFYAEYcSvAdsASsAjMAyNuBVgGtgMWheaBEbcitJ3QErAILADzwEhmBVheQGfig9ssncgCqyeLjfRioZkFVhfzb7QCZjrrbtesNJu4qbpYbo8AZjrbtUcAc52l9lhuqnYWZ1sB072F2Qww25ufzV2y9nrAKjfVW5ltJTTdW57NCM32tjtv7pKl2SahVZmpdxY/ZasvWXg1/cNmftX82fMsOg+YvVobNmxHvAgsAPPQ/rPRaDR64qQzN8dNVW4amAXmgE3cVOW2AqaBGaFZYA7YJLQqMyW01TdMQxu2+oYpoZHUJqE5YFZoBpgGtgJGyCZg7opsunKr123qBm115aavyFZCU9/ZDwywW2k08j9s4RsWhZaEtgOWgRWhVWQeWACWgO2AZWAVWQCWgBVg7MQX+2SwUiS8JcwAAAAASUVORK5CYII=" /><div class="container" style=""><div style="text-align:center;margin-bottom:15px"><img alt="" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTQ2IiBoZWlnaHQ9IjIwIiB2aWV3Qm94PSIwIDAgMTQ2IDIwIiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTIxLjgzOTUgMTkuNTU3NUMyMy45NDE2IDE5LjA0MTIgMjYgMTcuODE3OCAyNiAxNC41MjExQzI2IDExLjY0NTYgMjUuMTMzNCAxMC4wNjQxIDIzLjk3NzggMTAuMDY0MUMyNS4xMzM0IDEwLjA2NDEgMjYgOC4zMzg4NCAyNiA1LjQ2MzM4QzI2IDMuODgxODcgMjUuMjc3OCAwIDE4Ljc3NzkgMEgxMi4wNDk0TDguNzI3MTEgMy4zMDY3N0gxMi41MDY3TDE0LjU1OSAxLjI2Mzk3TDE0LjYzMTQgMS4xOTIwMUgxNC43MzM2SDE3LjA0NDZIMTkuMjExNEMyMC4wMzk0IDEuMTkyMDEgMjEuMzQ5MyAxLjQxNDcxIDIyLjQ2MDkgMi4wNzEwNkMyMy41ODQgMi43MzQyNiAyNC41MTM2IDMuODQ4OTUgMjQuNTEzNiA1LjYwNzEzQzI0LjUxMzYgNy41NDA3MyAyMy44MzU2IDguNzA2NjUgMjIuNzkzMSA5LjM3MjMxQzIyLjMyMDUgOS42NzQxMiAyMS43ODIyIDkuODY2NjYgMjEuMjE3NiA5Ljk4NjM4QzIxLjc5MTMgMTAuMTcwNiAyMi4zMzMyIDEwLjQzNjMgMjIuODA2MSAxMC43ODI4QzIzLjgxNzggMTEuNTIzNyAyNC41MTM2IDEyLjYzNTggMjQuNTEzNiAxNC4wODk3QzI0LjUxMzYgMTUuMzUzMSAyNC4xNzcyIDE2LjUwNDcgMjMuMzE5OSAxNy4zMzg2QzIyLjcyMzIgMTcuOTE5MSAyMS44OTM4IDE4LjMyNjQgMjAuNzk3NyAxOC41MjA0TDIxLjgzOTUgMTkuNTU3NVpNMTIuMTM3NiA5LjkwMDQyTDEwLjU2ODcgOC4zMzg4NEgxNy44MjNMMTYuMjU0MSA5LjkwMDQySDEyLjEzNzZaTTEzLjg5MDkgMTEuNjQ1NkwxMi40NjY3IDEwLjIyOEgxNi4zMjIySDE2LjM5MDVMMTYuNDM4NyAxMC4xOEwxOC4yODg0IDguMzM4ODRIMTkuMzU1N0MyMS41MjIyIDguMzM4ODQgMjIuMzg5IDcuMDQ0ODggMjIuMzg5IDUuNzUwOTJDMjIuMzg5IDQuMzEzMTkgMjEuODExMiAzLjMwNjc3IDE5LjM1NTcgMy4zMDY3N0gxMy4yMDQ5TDE0LjgzNTggMS42ODMzOUgxNy4wNDQ2SDE5LjIxMTRDMTkuOTcyMSAxLjY4MzM5IDIxLjE5IDEuODkyMDIgMjIuMjA4OSAyLjQ5MzY4QzIzLjIxNjQgMy4wODg0OCAyNC4wMTk5IDQuMDU4NTIgMjQuMDE5OSA1LjYwNzEzQzI0LjAxOTkgNy40MTE2MSAyMy4zOTggOC40MDIyOSAyMi41MjY1IDguOTU4NzJDMjEuNjMyNSA5LjUyOTU5IDIwLjQzMDEgOS42NzQ2MyAxOS4yMTE0IDkuNjc0NjNWMTAuMTY2QzIwLjM5NDcgMTAuMTY2IDIxLjYwNTMgMTAuNTEzMyAyMi41MTM1IDExLjE3ODVDMjMuNDE1OCAxMS44MzkzIDI0LjAxOTkgMTIuODExOSAyNC4wMTk5IDE0LjA4OTdDMjQuMDE5OSAxNS4yNzA2IDIzLjcwNjQgMTYuMjc1NSAyMi45NzQ4IDE2Ljk4NzJDMjIuNDA4NCAxNy41MzgxIDIxLjU2NzMgMTcuOTM2OCAyMC4zNjQ0IDE4LjA4OTFMMTguOTQ2NCAxNi42Nzc3SDE5LjM1NTdDMjEuMjMzNCAxNi42Nzc3IDIyLjM4OSAxNS4yMzk5IDIyLjM4OSAxNC4wODk4QzIyLjM4OSAxMi45Mzk2IDIxLjgxMTIgMTEuNjQ1NiAxOS4zNTU3IDExLjY0NTZIMTMuODkwOVpNNS41MTMxNSAzLjMwNjc3TDMuODgyMjMgMS42ODMzOUg2LjIxMTUzSDYuMzEzNzJMNi4zODU5NiAxLjYxMTQzTDguMDA0ODcgMEgxMS4zNTExTDguMDI5MDcgMy4zMDY3N0g1LjUxMzE1Wk0xLjk4MDYxIDMuNDk2NzZMMy4zNDgyNCA0Ljg1ODA1VjkuMTE2MDdMMCAxMi40NDg3VjguMjU1MzdMMS45MDgyIDYuMzU1OTVMMS45ODA2MSA2LjI4Mzk5VjYuMTgyMjFWMy40OTY3NlpNMy4zODg1NiAxLjE5MjAxSDYuMTA5MThMNy4zMDY4MiAwSDMuMzQ4MjRIMi4xOTEwOEwzLjM4ODU2IDEuMTkyMDFaTTAuMDAwMzI4OTMzIDBIMFYwLjAwMDI2MTAyMUwwLjAwMDMyODkzMyAwWk0wIDEuNTI1MzdMMS40ODY5NCAzLjAwNTM3VjYuMDgwNDRMMCA3LjU2MDQ1VjEuNTI1MzdaTTE1LjIwODcgMTYuNjYzNkwxOC41NTY5IDE5Ljk5NjFDMTguMzQ0MiAyMC4wMDIyIDE4LjA2NzIgMjAuMDAwMiAxNy44MzA3IDE5Ljk5NjNIMTUuMzgzNEwxMi4wMzUyIDE2LjY2MzZIMTUuMjA4N1pNMCAxMy4xNDM3VjE5Ljk5NlYxOS45OTYzSDEwLjM1Mkw4Ljk5ODE0IDE4LjY0ODZIMS43MzM3N0gxLjQ4Njk0VjE4LjQwMjlWMTYuMTAyNlYxNi4wMDA4TDEuNTU5MTggMTUuOTI4OEwzLjM0ODI0IDE0LjE0ODFWOS44MTA5OEwwIDEzLjE0MzdaTTMuMzQ4MjQgMTQuODQzTDEuOTgwNjEgMTYuMjA0M1YxOC4xNTcySDkuMTAwMzNIOS4yMDI1Mkw5LjI3NDkzIDE4LjIyOTFMMTEuMDUwMiAxOS45OTYzSDE0LjY4NTJMMTEuMzM3IDE2LjY2MzZIMy4zNDgyNFYxNC44NDNaIiBmaWxsPSIjRjcxQjNBIi8+CjxwYXRoIGQ9Ik0xNDYgMkg4NVYxOEgxNDZWMloiIGZpbGw9IiNGNzFCM0EiLz4KPHBhdGggZD0iTTM1IDMuNjAxMDVIMzcuOTE2N1YxMy43OTEySDQxLjgzNzJWMTYuMjU4MUgzNVYzLjYwMTA1Wk01MC41MjU4IDMuMzE2NDFDNTIuNTIwNyAzLjMxNjQxIDU0LjE0OTUgMy45Mjk4OSA1NS40MTIyIDUuMTU3MDlDNTYuNzI1NCA2LjQzNDc0IDU3LjM4MTggOC4wMjg3MyA1Ny4zODE4IDkuOTM5MDZDNTcuMzgxOCAxMS44MjM5IDU2LjcyNTQgMTMuNDA1NCA1NS40MTIyIDE0LjY4MzFDNTQuMTM2OSAxNS45MjI4IDUyLjUwODEgMTYuNTQyNyA1MC41MjU4IDE2LjU0MjdDNDguNTMwOCAxNi41NDI3IDQ2Ljg4OTQgMTUuOTIyOCA0NS42MDE1IDE0LjY4MzFDNDQuOTgyOCAxNC4xMDExIDQ0LjQ5NjcgMTMuNDA1NCA0NC4xNDMyIDEyLjU5NTdDNDMuODAyMyAxMS43NzM1IDQzLjYzMTggMTAuOTAwNiA0My42MzE4IDkuOTc3MDJDNDMuNjMxOCA5LjA5MTM5IDQzLjgwODYgOC4yMTg0OSA0NC4xNjIxIDcuMzU4MzFDNDQuNTI4MyA2LjQ4NTQxIDQ1LjAwMTggNS43NTgwNyA0NS41ODI2IDUuMTc2MDZDNDYuODIgMy45MzYzNyA0OC40Njc3IDMuMzE2NDEgNTAuNTI1OCAzLjMxNjQxWk01MC41MDY5IDYuMDExMDFDNDkuMzgzMSA2LjAxMTAxIDQ4LjQ2MTQgNi4zNzE1NiA0Ny43NDE3IDcuMDkyNjVDNDYuOTk2NyA3LjgxMzc0IDQ2LjYyNDMgOC43Njg4IDQ2LjYyNDMgOS45NTgwNEM0Ni42MjQzIDExLjA5NjYgNDcuMDA5NCAxMi4wNDU0IDQ3Ljc3OTYgMTIuODA0NUM0OC41MTE5IDEzLjUwMDMgNDkuNDE0NyAxMy44NDgxIDUwLjQ4NzkgMTMuODQ4MUM1MS42MzY5IDEzLjg0ODEgNTIuNTcxMyAxMy40ODc2IDUzLjI5MSAxMi43NjY1QzU0LjAyMzMgMTIuMDU4MSA1NC4zODk0IDExLjExNTYgNTQuMzg5NCA5LjkzOTA2QzU0LjM4OTQgOC43NzUyNyA1NC4wMjMzIDcuODI2NDcgNTMuMjkxIDcuMDkyNjVDNTIuNTQ2IDYuMzcxNTYgNTEuNjE4IDYuMDExMDEgNTAuNTA2OSA2LjAxMTAxWk02OS44MTcgMTIuNTAwOFYxNS44NTk2QzY4LjkyMDYgMTYuMzE1IDY3Ljk5MjYgMTYuNTQyNyA2Ny4wMzI5IDE2LjU0MjdDNjQuOTc0OCAxNi41NDI3IDYzLjMyMDggMTUuOTI5MyA2Mi4wNzA4IDE0LjcwMjFDNjAuNzU3NyAxMy40MjQ0IDYwLjEwMTEgMTEuODIzOSA2MC4xMDExIDkuOTAxMTFDNjAuMTAxMSA4LjAwMzUgNjAuNzU3NyA2LjQxNTc2IDYyLjA3MDggNS4xMzgxMUM2My4zMjA4IDMuOTIzNjQgNjQuODkyOCAzLjMxNjQxIDY2Ljc4NjcgMy4zMTY0MUM2Ny43MjEgMy4zMTY0MSA2OC43MzEyIDMuNTUwMzcgNjkuODE3IDQuMDE4NTJWNy4zOTYyNkM2OC45NzEgNi40OTgxNCA2Ny45ODYxIDYuMDQ4OTYgNjYuODYyNSA2LjA0ODk2QzY1LjgyNyA2LjA0ODk2IDY0Ljk2ODUgNi4zNzc4MSA2NC4yODY3IDcuMDM1NzJDNjMuNDkxMiA3LjgwNzQ5IDYzLjA5MzUgOC43ODE1MiA2My4wOTM1IDkuOTU4MDRDNjMuMDkzNSAxMS4xMDkzIDYzLjQ1OTYgMTIuMDM5MiA2NC4xOTIgMTIuNzQ3NUM2NC44OTkgMTMuNDU1OSA2NS44MDgxIDEzLjgxMDIgNjYuOTE5MyAxMy44MTAyQzY3Ljk2NzIgMTMuODEwMiA2OC45MzMxIDEzLjM3MzcgNjkuODE3IDEyLjUwMDhaTTc2LjIwODUgMy42MDEwNVY4Ljg3NjRMODAuNTI2NyAzLjYwMTA1SDg0LjA4NzRMNzguOTczNyA5LjU5NzQ5TDg0LjQ4NTEgMTYuMjU4MUg4MC43MzUxTDc2LjIwODUgMTAuNjQxMlYxNi4yNTgxSDczLjI5MTlWMy42MDEwNUg3Ni4yMDg1WiIgZmlsbD0iIzIyMjIyMiIvPgo8cGF0aCBkPSJNODcuMTE3MiAzLjYwMTU2SDkwLjk4MDhDOTIuNDQ1NCAzLjYwMTU2IDkzLjUxODcgMy45MjQxNiA5NC4yMDA2IDQuNTY5MzRDOTQuODA2NiA1LjE1MTM1IDk1LjEwOTcgNS45NDgzNSA5NS4xMDk3IDYuOTYwMzNDOTUuMTA5NyA3LjU5Mjc5IDk0Ljk3MDggOC4xMzA2IDk0LjY5MyA4LjU3MzNDOTQuNDQwNSA4Ljk5MDc3IDk0LjA4NjkgOS4zMDA2NCA5My42MzI0IDkuNTAzMTNDOTQuMzM5NCA5LjYxNjk4IDk0LjkyMDMgOS45MDE2MyA5NS4zNzQ4IDEwLjM1NzFDOTUuOTE3OCAxMC45MDExIDk2LjE4OTIgMTEuNjUzNyA5Ni4xODkyIDEyLjYxNTJDOTYuMTg5MiAxMy42NjUxIDk1Ljg2MSAxNC41MTkxIDk1LjIwNDQgMTUuMTc3Qzk0LjQ1OTUgMTUuODk4MSA5My4zNDgzIDE2LjI1ODYgOTEuODcxIDE2LjI1ODZIODcuMTE3MlYzLjYwMTU2Wk04OS45OTYgNS44Nzg3VjguNzQ0MDhIOTAuNDY5NUM5MS4xMjYxIDguNzQ0MDggOTEuNjE4NiA4LjYyMzk4IDkxLjk0NjggOC4zODM1NEM5Mi4yODc3IDguMTQzMSA5Mi40NTgxIDcuNzcwMDUgOTIuNDU4MSA3LjI2Mzk1QzkyLjQ1ODEgNi44MDg1MiA5Mi4yOTM5IDYuNDU0MjMgOTEuOTY1NyA2LjIwMTI5QzkxLjY4NzggNS45ODYzIDkxLjE4MjkgNS44Nzg3IDkwLjQ1MDUgNS44Nzg3SDg5Ljk5NlpNODkuOTk2IDEwLjkwNzRWMTMuOTgxNUg5MC42OTY4QzkxLjc3MDEgMTMuOTgxNSA5Mi40ODk4IDEzLjgxMDcgOTIuODU1OSAxMy40NjkxQzkzLjEzMzcgMTMuMjE2MiA5My4yNzI1IDEyLjg2MTkgOTMuMjcyNSAxMi40MDY1QzkzLjI3MjUgMTEuOTYzOCA5My4xNCAxMS42MjIyIDkyLjg3NDggMTEuMzgxOEM5Mi41MzM5IDExLjA2NTQgOTEuODM5NCAxMC45MDc0IDkwLjc5MTUgMTAuOTA3NEg4OS45OTZaTTk5LjU1NTggMy42MDE1NkgxMDIuNDcyVjE2LjI1ODZIOTkuNTU1OFYzLjYwMTU2Wk0xMTMuNjAyIDYuMDY4NDVIMTEwLjg1NlYxNi4yNTg2SDEwNy45MzlWNi4wNjg0NUgxMDUuMTkzVjMuNjAxNTZIMTEzLjYwMlY2LjA2ODQ1WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZD0iTTEyNi4xNDYgMTMuNTNWMTZIMTE2LjQ1NkwxMjAuMjU2IDExLjg1OEMxMjEuMTgxIDEwLjgxOTMgMTIxLjg3MSA5Ljk1OCAxMjIuMzI3IDkuMjc0QzEyMi44MzQgOC40NjMzMyAxMjMuMDg3IDcuNzQ3NjcgMTIzLjA4NyA3LjEyN0MxMjMuMDg3IDYuNTk1IDEyMi45MjIgNi4xNzcgMTIyLjU5MyA1Ljg3M0MxMjIuMzI3IDUuNjMyMzMgMTIxLjk0MSA1LjUxMiAxMjEuNDM0IDUuNTEyQzEyMC45NCA1LjUxMiAxMjAuNTU0IDUuNjY0IDEyMC4yNzUgNS45NjhDMTE5LjkyIDYuMzYwNjcgMTE5Ljc0MyA2Ljg4IDExOS43NDMgNy41MjZIMTE2LjgxN0MxMTYuOTMxIDYuMjA4NjcgMTE3LjM2OCA1LjE1MSAxMTguMTI4IDQuMzUzQzExOC45NTEgMy40NzkgMTIwLjExNyAzLjA0MiAxMjEuNjI0IDMuMDQyQzEyMi45NzkgMy4wNDIgMTI0LjA3NSAzLjQ0MSAxMjQuOTExIDQuMjM5QzEyNS42OTYgNS4wMjQzMyAxMjYuMDg5IDYuMDM3NjcgMTI2LjA4OSA3LjI3OUMxMjYuMDg5IDguMjU0MzMgMTI1Ljc3MiA5LjE4NTMzIDEyNS4xMzkgMTAuMDcyQzEyNC43NTkgMTAuNjA0IDEyNC4wODEgMTEuMzMyMyAxMjMuMTA2IDEyLjI1N0wxMjEuNzc2IDEzLjUzSDEyNi4xNDZaTTEyNy44NDkgMTUuODFDMTI3LjUxOSAxNS40NjggMTI3LjM1NSAxNS4wNTYzIDEyNy4zNTUgMTQuNTc1QzEyNy4zNTUgMTQuMDkzNyAxMjcuNTE5IDEzLjY4ODMgMTI3Ljg0OSAxMy4zNTlDMTI4LjE5MSAxMy4wMTcgMTI4LjYwMiAxMi44NDYgMTI5LjA4NCAxMi44NDZDMTI5LjU2NSAxMi44NDYgMTI5Ljk3IDEzLjAxNyAxMzAuMyAxMy4zNTlDMTMwLjY0MiAxMy42ODgzIDEzMC44MTMgMTQuMDkzNyAxMzAuODEzIDE0LjU3NUMxMzAuODEzIDE1LjA1NjMgMTMwLjY0MiAxNS40NjggMTMwLjMgMTUuODFDMTI5Ljk3IDE2LjEzOTMgMTI5LjU2NSAxNi4zMDQgMTI5LjA4NCAxNi4zMDRDMTI4LjYwMiAxNi4zMDQgMTI4LjE5MSAxNi4xMzkzIDEyNy44NDkgMTUuODFaTTE0MS42ODcgOS42NzNDMTQxLjY4NyAxMi4wMDM3IDE0MS4wNzkgMTMuNzcwNyAxMzkuODYzIDE0Ljk3NEMxMzguOTYzIDE1Ljg0OCAxMzcuODMgMTYuMjg1IDEzNi40NjIgMTYuMjg1QzEzNS4xMTkgMTYuMjg1IDEzMy45OTggMTUuODQ4IDEzMy4wOTkgMTQuOTc0QzEzMS44ODMgMTMuNzcwNyAxMzEuMjc1IDEyLjAwMzcgMTMxLjI3NSA5LjY3M0MxMzEuMjc1IDcuMzA0MzMgMTMxLjg4MyA1LjUzMSAxMzMuMDk5IDQuMzUzQzEzMy45OTggMy40NzkgMTM1LjExOSAzLjA0MiAxMzYuNDYyIDMuMDQyQzEzNy44MyAzLjA0MiAxMzguOTYzIDMuNDc5IDEzOS44NjMgNC4zNTNDMTQxLjA3OSA1LjUzMSAxNDEuNjg3IDcuMzA0MzMgMTQxLjY4NyA5LjY3M1pNMTM3LjY1OSA2LjAyNUMxMzcuMzI5IDUuNzA4MzMgMTM2LjkzNyA1LjU1IDEzNi40ODEgNS41NUMxMzYuMDI1IDUuNTUgMTM1LjYzMiA1LjcwODMzIDEzNS4zMDMgNi4wMjVDMTM0LjU5MyA2LjcyMTY3IDEzNC4yMzkgNy45MzEzMyAxMzQuMjM5IDkuNjU0QzEzNC4yMzkgMTEuMzg5MyAxMzQuNTkzIDEyLjYwNTMgMTM1LjMwMyAxMy4zMDJDMTM1LjYzMiAxMy42MTg3IDEzNi4wMjUgMTMuNzc3IDEzNi40ODEgMTMuNzc3QzEzNi45MzcgMTMuNzc3IDEzNy4zMjkgMTMuNjE4NyAxMzcuNjU5IDEzLjMwMkMxMzguMzY4IDEyLjYwNTMgMTM4LjcyMyAxMS4zODkzIDEzOC43MjMgOS42NTRDMTM4LjcyMyA3LjkzMTMzIDEzOC4zNjggNi43MjE2NyAxMzcuNjU5IDYuMDI1WiIgZmlsbD0id2hpdGUiLz4KPC9zdmc+Cg==" /></div><div class="hb" style="text-align:center"><img alt="" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNTc5IiBoZWlnaHQ9IjI1IiB2aWV3Qm94PSIwIDAgNTc5IDI1IiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8cmVjdCB4PSI5OSIgd2lkdGg9IjE3OSIgaGVpZ2h0PSIyNSIgZmlsbD0iI0Y3MUIzQSIvPgo8cmVjdCB4PSIzMjUiIHdpZHRoPSIyNTQiIGhlaWdodD0iMjUiIGZpbGw9IiNGNzFCM0EiLz4KPHBhdGggZD0iTTEzLjM2IDIwSDEwLjY3Mkw5LjYxNiAxNi45NTJINC4xNjhMMy4xMTIgMjBIMC40MjRMNS40NCA1LjY0OEg4LjM2OEwxMy4zNiAyMFpNOC44MjQgMTQuNTUyTDYuOTA0IDguODg4TDQuOTYgMTQuNTUySDguODI0Wk0yNC4xMDc5IDIwSDE1LjIyNzlWNS42NDhIMTcuNzQ3OVYxNy42SDI0LjEwNzlWMjBaTTM1LjYzOTEgMjBIMjYuNzU5MVY1LjY0OEgyOS4yNzkxVjE3LjZIMzUuNjM5MVYyMFpNNTQuNDUwOCA1LjY0OEw0OS42OTg4IDEzLjczNlYyMEg0Ny4xNzg4VjEzLjczNkw0Mi40NzQ4IDUuNjQ4SDQ1LjI1ODhMNDguNDUwOCAxMS4wOTZMNTEuNjQyOCA1LjY0OEg1NC40NTA4Wk02Ny4zMjc2IDE2LjU5MkM2Ny4zMjc2IDE3LjEyIDY3LjE5OTYgMTcuNTc2IDY2Ljk0MzYgMTcuOTZDNjYuNzUxNiAxOC4yMTYgNjYuNDYzNiAxOC41MzYgNjYuMDc5NiAxOC45MkM2NS43MTE2IDE5LjMwNCA2NS40MTU2IDE5LjU2IDY1LjE5MTYgMTkuNjg4QzY0LjcyNzYgMTkuOTc2IDY0LjIzMTYgMjAuMTIgNjMuNzAzNiAyMC4xMkg2MC4wNTU2QzU5LjUyNzYgMjAuMTIgNTkuMDMxNiAxOS45NzYgNTguNTY3NiAxOS42ODhDNTguMzQzNiAxOS41NiA1OC4wMzE2IDE5LjMwNCA1Ny42MzE2IDE4LjkyQzU3LjI0NzYgMTguNTIgNTYuOTc1NiAxOC4yIDU2LjgxNTYgMTcuOTZDNTYuNTU5NiAxNy41NzYgNTYuNDMxNiAxNy4xMiA1Ni40MzE2IDE2LjU5MlY5LjA4QzU2LjQzMTYgOC41NTIgNTYuNTU5NiA4LjA5NiA1Ni44MTU2IDcuNzEyQzU2Ljk3NTYgNy40NzIgNTcuMjQ3NiA3LjE2IDU3LjYzMTYgNi43NzZDNTguMDMxNiA2LjM3NiA1OC4zNDM2IDYuMTEyIDU4LjU2NzYgNS45ODRDNTkuMDMxNiA1LjY5NiA1OS41Mjc2IDUuNTUyIDYwLjA1NTYgNS41NTJINjMuNzAzNkM2NC4yMzE2IDUuNTUyIDY0LjcyNzYgNS42OTYgNjUuMTkxNiA1Ljk4NEM2NS40MTU2IDYuMTEyIDY1LjcxMTYgNi4zNjggNjYuMDc5NiA2Ljc1MkM2Ni40NjM2IDcuMTM2IDY2Ljc1MTYgNy40NTYgNjYuOTQzNiA3LjcxMkM2Ny4xOTk2IDguMDk2IDY3LjMyNzYgOC41NTIgNjcuMzI3NiA5LjA4VjE2LjU5MlpNNTguOTUxNiA5LjE1MlYxNi41NjhDNTguOTUxNiAxNi42MTYgNTguOTU5NiAxNi42NDggNTguOTc1NiAxNi42NjRDNTkuMjk1NiAxNy4xNDQgNTkuNjQ3NiAxNy40ODggNjAuMDMxNiAxNy42OTZDNjAuMDYzNiAxNy43MTIgNjAuMTAzNiAxNy43MiA2MC4xNTE2IDE3LjcySDYzLjYwNzZDNjMuNjU1NiAxNy43MiA2My42OTU2IDE3LjcxMiA2My43Mjc2IDE3LjY5NkM2NC4xMTE2IDE3LjQ4OCA2NC40NjM2IDE3LjE0NCA2NC43ODM2IDE2LjY2NEw2NC44MDc2IDE2LjU2OFY5LjE1MkM2NC44MDc2IDkuMDg4IDY0Ljc5OTYgOS4wNDggNjQuNzgzNiA5LjAzMkM2NC40NDc2IDguNTM2IDY0LjA5NTYgOC4xODQgNjMuNzI3NiA3Ljk3NkM2My42OTU2IDcuOTYgNjMuNjU1NiA3Ljk1MiA2My42MDc2IDcuOTUySDYwLjE1MTZDNjAuMDg3NiA3Ljk1MiA2MC4wNDc2IDcuOTYgNjAuMDMxNiA3Ljk3NkM1OS42NjM2IDguMTg0IDU5LjMxMTYgOC41MzYgNTguOTc1NiA5LjAzMkw1OC45NTE2IDkuMTUyWk03OC4wNzY0IDE2LjU2OFY1LjY0OEg4MC41OTY0VjE2LjU5MkM4MC41OTY0IDE3LjEyIDgwLjQ2ODQgMTcuNTc2IDgwLjIxMjQgMTcuOTZDODAuMDM2NCAxOC4yIDc5Ljc1NjQgMTguNTIgNzkuMzcyNCAxOC45MkM3OS4wMDQ0IDE5LjMwNCA3OC43MDA0IDE5LjU2IDc4LjQ2MDQgMTkuNjg4Qzc3Ljk5NjQgMTkuOTc2IDc3LjUwODQgMjAuMTIgNzYuOTk2NCAyMC4xMkg3My45NDg0QzczLjQyMDQgMjAuMTIgNzIuOTI0NCAxOS45NzYgNzIuNDYwNCAxOS42ODhDNzIuMjM2NCAxOS41NiA3MS45MjQ0IDE5LjMwNCA3MS41MjQ0IDE4LjkyQzcxLjE0MDQgMTguNTIgNzAuODY4NCAxOC4yIDcwLjcwODQgMTcuOTZDNzAuNDUyNCAxNy41NzYgNzAuMzI0NCAxNy4xMiA3MC4zM
URLs

http-equiv="Content-Type"

http-equiv="x-ua-compatible"

https://decoding.at

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\bin\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: D89C6F255199BB9E650A68C52645DCAF
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Program Files\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: D89C6F255199BB9EB47678D3103C97A8
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Users\Admin\Desktop\LockBit_Ransomware.hta

Ransom Note
Any attempts to restore your files with the thrid-party software will be fatal for your files! To recovery your data and not to allow data leakage, it is possible only through purchase of a private key from us There is only one way to get your files back: Through a standard browser Brave (supports Tor links) FireFox Chrome Edge Opera Open link - https://decoding.at/ Through a Tor Browser - recommended Download Tor Browser - https://www.torproject.org/ and install it. Open one of links in Tor browser and follow instructions on these pages: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or mirrorhttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion/These links work only in the Tor browser! Follow the instructions on this page https://decoding.at may be blocked. We recommend using a Tor browser (or Brave) to access the TOR site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about All your stolen important data will be loaded into our blog if you do not pay ransom. Our blog http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion or https://bigblog.at where you can see data of the companies which refused to pay ransom.
URLs

https://decoding.at/

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/or

https://decoding.at

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

Extracted

Path

C:\Program Files\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: D89C6F255199BB9E0B383F55A56BFD57
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Program Files\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: D89C6F255199BB9EA4D1D528D31CFD8B
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Targets

    • Target

      7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c.exe

    • Size

      894KB

    • MD5

      ec8fef72a73ff94440235fc1b3f3f690

    • SHA1

      e651cd12a2493b9c2d7ebd8287a2fd29b8f4cd9c

    • SHA256

      7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c

    • SHA512

      b62f2f518f4ed3d74d96551a8c7431d50bd3349221b4b01dded18a270cbdbd1441f13f3eef7a6cc0db4aad200f1cf2babeb8e937edf8827faa7a03e4b59a35f2

    • SSDEEP

      12288:d31hZus7pQqiiyuuFuawu2zhjWBv4+1FMUUfW75CXQKXTZ1VG:1r1S+NjWx4+1SWV6Q4n

    Score
    9/10
    credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (12699) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2behavioral3behavioral4behavioral5

    • Target

      87b9b910d5d5a053e3b39989cc6fd51601abdaea207a26c765f21f43a4cd4dcb.exe

    • Size

      79KB

    • MD5

      c8579ccb6690e1f2102f9ba887c12f9e

    • SHA1

      e8e46e3f88011aa43c90cde3c9945e3508986a25

    • SHA256

      87b9b910d5d5a053e3b39989cc6fd51601abdaea207a26c765f21f43a4cd4dcb

    • SHA512

      f579e9b39400a0b3879dc8a1c41bd829d8f6b399d9d0a97302f7157a76f036ede5e4391eeb12bd2285a7f523969d572a92f482cf415ed2fb023d96d745f82244

    • SSDEEP

      1536:hxpkWBeG/vEbKsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2Xsf8:/BeQsKsrQLOJgY8Zp8LHD4XWaNH71dLH

    Score
    10/10
    defense_evasiondiscoveryexecutionimpactransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (169) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral6behavioral7behavioral8behavioral9

    • Target

      8958d7b8c51215d6a27444b2760f1ce843a414d380052e6e71c2af6e9ab69ce2.exe

    • Size

      959KB

    • MD5

      734f101d7a5822e1bf2c66e398ab8c45

    • SHA1

      cafb5d0e3db6804693e8461b32abf678e8c70f3d

    • SHA256

      8958d7b8c51215d6a27444b2760f1ce843a414d380052e6e71c2af6e9ab69ce2

    • SHA512

      63cf6ae43a26ce38c062ec69bbc084ba3e8777d3f6f574e6a0a09242cacb46989d01c1dcb32943692c47361f8d6fb8e5009a4cc917a80ffa567cb2a853f1a2fb

    • SSDEEP

      24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpd2F:Ujrc2So1Ff+B3k796Q

    Score
    10/10
    lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Lockbit family

      lockbit

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral11behavioral12behavioral13behavioral14behavioral15

    • Target

      ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09.exe

    • Size

      88KB

    • MD5

      56299609780e2286ccc2cf5857d531e8

    • SHA1

      ef7baf17905784df491641906645f00f73eff1d1

    • SHA256

      ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09

    • SHA512

      a44053d0c810448adddcd17e51682e43d51710de948644c82a141a1a8104cacedd44a274f13ea79de89f5cdfbb0e436791565baad1552d9853a5a94b446398cb

    • SSDEEP

      1536:7vie0XQsxILOW3Sm9S4AndhgXCpC1VYEzcM5BD11e0z:OeBsxInSNnhgX4CzwM

    Score
    10/10
    dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Dharma family

      dharma

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (785) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral16behavioral17behavioral18behavioral19behavioral20

    • Target

      b228a698ee826b42e19307f2d34c2620819a67a0e98fd2af08aae570b8178cc0.exe

    • Size

      65KB

    • MD5

      1f31e5377d64f9f26c12f3b7a5545c16

    • SHA1

      b54fdfadaa8c9eec27f2f48e462bde898383f0ba

    • SHA256

      b228a698ee826b42e19307f2d34c2620819a67a0e98fd2af08aae570b8178cc0

    • SHA512

      ff6d85ed6be933d5c90dc8a2554cdc69eeb00f1dbc20a6016ec4813feb9310eab25e93071f93f1d65f1f7453f65d5a830e8e7ff9b1d0846fe969b55a2a340129

    • SSDEEP

      768:5PuzmZ5OzkfCQxmGgV5YlpJ6RIDWeRdppvO/9rjca9zsUKh51zb2Z:5PEz5Qxd6m3WIw9oh5B2Z

    Score
    1/10
    behavioral21behavioral22behavioral23behavioral24behavioral25

    • Target

      c864a70f78fb972f505ae5b13c0ad984e64c547194beb258926bb4c323fac31d.exe

    • Size

      67KB

    • MD5

      5854152baa338613d80ee24af054cfbe

    • SHA1

      2f779048a40cb601af32fe70188c9d3e53e71efe

    • SHA256

      c864a70f78fb972f505ae5b13c0ad984e64c547194beb258926bb4c323fac31d

    • SHA512

      55572a3e99a5ee08dd1319ad565584a4d6680a0aaf50819228c6ec7ab0b6a509dba25de539213e9f3b5bb6e3720344db4d26e52f0fe08c028511f9830f552b18

    • SSDEEP

      768:RVel5lzkfCQxmGgV5YlpJ6RIDWeRdppvO/9rjca9fsUKhnLZbp:Rcz5Qxd6m3WIw9EhX

    Score
    1/10
    behavioral26behavioral27behavioral28behavioral29behavioral30

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

3
T1490

Tasks

static1

upx512478c08dada2af19e49808fbda5b0bmakopchaosnefilimmimicblackmattermodiloadergandcrablockbit
Score
10/10

behavioral1

credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
9/10

behavioral2

credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
9/10

behavioral3

credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
9/10

behavioral4

credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
9/10

behavioral5

credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
9/10

behavioral6

defense_evasiondiscoveryexecutionimpactransomware
Score
10/10

behavioral7

defense_evasiondiscoveryexecutionimpactransomware
Score
10/10

behavioral8

defense_evasiondiscoveryexecutionimpactransomware
Score
10/10

behavioral9

defense_evasiondiscoveryexecutionimpactransomware
Score
10/10

behavioral10

defense_evasiondiscoveryexecutionimpactransomware
Score
10/10

behavioral11

lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral12

lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral13

lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral14

lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral15

lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware
Score
10/10

behavioral16

dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
10/10

behavioral17

dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
10/10

behavioral18

dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
10/10

behavioral19

dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
10/10

behavioral20

dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
10/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10