Overview

overview

10

Static

static

3

6b03fddacd...21.exe

windows10-2004-x64

10

6b03fddacd...21.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6b03fddacd44cf7e1ba8ed899119a3b1e024f70670281589807cdd92c3314221.exe
  • Size 284KB
  • Sample260703-t174sacy7v
  • SHA256 6b03fddacd44cf7e1ba8ed899119a3b1e024f70670281589807cdd92c3314221
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lockbitcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Program Files\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal id 3. We will decrypt 1 file for test(maximum file size - 2MG), it is guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help if third parties may cause increase price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: qyJmc7OwhMBafUYRNJKUF3hXk9rV8Eik09Ht1LcFg8swgqNM70BGLl/YQITklegK7p9RSSa0R6ph Hmj/pzzMjkrt7TK1vtmnKT/7W+F8UIZllS1Rh01xsSV6HbXZFeOoEr4qp/cr7VuUoYklJprQ2ILM RLbYL5+ptca5dSixLeiMgX317uDKVeystAeM/ywdZUDV3X8nTQIynyC38OHA8XaxPUWiAXNur0nk ltkQL0ZO+r8yXj9B6UpVZSKasP7LCiW+Ex6M81zDFRl6RP0uZDW3wd0YdISsp2ucU8ZVB2Fv44TJ btObj0NgLEtCE6g9zjMg/QeyQcMYh6Rc4Kn8Yq8dKCRR8wP4++Fhsao5VYh0RaYEBiQQJK+CwC3P tJdoyXq9XKETDXsNDjzHHNPNm9B0fb8mgwaZAVSjt2mhFL/kLjueLkDzpLryQHgZsk8/ZJF6c+XK +IcNEzxZDwvnrHikfLdlZDDJAstUGvGM22owBZLHr8enaBDfDco8UW5vUT3WPReFXSZYZw4Eej/a NAGmaOZ+1kLAFovK3a9tYxH1+gc/dRVIQbvnN7ib7RUmapv/AxyS6Fr6XuaP7HbAN1fnc88SxZ0V ldHOL+YUuep311DpF0l/4Qu7xMhSOWke9mHG3Lej3Vy9FTV5EvN9BerA4T1iLhxYKIb8bhtUotUd 8i6S79f6ZuUiDCuglKHzlRpm5n8NDXbmbXSMsmIBEzQFuMZybNRgPWKYLd2+xvcO3GfRAB6wd766 ATxfr0QIfO+eyoWfgk7956/sPjar/01B5MSXIgDREue/G5t5V81V8V4CtxQxx6oJXStg6gwIJ6+B AcTlyd0QZ9XViXjRMW+fCV5C17hDnGgEMUjX7C59NT0P73FOWPPvLnyS6S5T/U2iokPK0sOssa5T NL74oRz88DuGG2Oo5F0djKb8ZNarL8IwN7NFMOPIygQlwGBWwcmESJBFQAlKr7l2IBZpu33qWu9B aoXa48MqzLq3Zase0F2qWarZ55G+sIe9FOI60eFb3Fqgt0OdMJQLO79HxK1GobeZafPIXWs1Lxx+ GnQ9RGwB64X2jcGEwbOptH+QxOlxvP6tMY3tL9nIf1ISGaNX7lAe/dzjZp1rh1rVVRX7uBWbAgtG mvGQ335GIBdom9Ywlz+1xj4pUdU1NVAA5og7KB2LKhgmHDyLiUCLJMpHbTvBBT0TqrMafnr50PqM pfgWtRrmuVGirITyB1HEvH4da2M+9IsYKWCxiW41h6uHNBWDCuLEaavdgrggKdM3WHtG+WGbf8Sm 5z7wrefpy/2GDJFgDP5y2S/5H9zcQa0vPyfB1IhIppbGNmIfvh61MkWzR2Ol/ibPKYCfQcuEROBs 4sRl4lmhVnB1lZA5DhKtThUXOUKvhFDuyjKFVqwxLqEeMfkIHGZOjpjG8EeIj4aRLdKGJggDrdj8 eaJBgd4agN++u6VjwvkNS+v7ginUi25k6zocbOQ/vJ6Fcrptw0J/BYiByrnXhq5IURpoAL5wI8nG lp++TvLoyb8Vx66PgZWtN+G/axWuM4Nbdie6th0Mbo9c75HqrXGWWSnPsxnaYHCQOGckNnM1ynWr 4XI0lZ0ef6Xm5/yemCjQ3NC2fIe+MIByQecrJd+fW+UgJMRLnLzSmFGNVo25QFRNADDnWPUrr/zS mtmxpc7/W6R+vGDup1il1iDkWpZDikh6x6O6LNJIDJEEODCPOhmALUbw/2ApL9N3BNAowBCDxI/X 7O4UGRj+ij+ORJlMtqFHX89Byt2Gr5Y2yy2JrUJOrk2oq9E6DyqGaob5fvTBYZyEqBk+7e7WPVnZ oyqikV1Xz9rQwvOp9wmeYiQsHpjruV3RdlCpUY3BWWyP2W+RaBWrlC8Mwq3mrFm9hINcySpdJcfx fh0nWlrWe2go3E5DsihMMm8bgCvRVJ3g1L9VxrfbKCN5uAh0XtqsBGQYvMSF9EKjxH8uBIYqQycL m27uj+UZHcBh8ZTXu8VNO/1uNE/Bc4ooZsczzJkUAI/ycqCwEIz44/SFQwczC7CEP9S0TXKM/g4l ET8652jC0jYqoUyU4R9E8Cks62s53+RQ2/Bw6rYaRJqJ1P+kpo3QGT8BJs2W8iVa376dYfIh5gPG atzDukdasPRMT8zEOv98zPoB4SIl42FO3neUIr6betELtt8d2NfZsP4N4Eke5DuDT7arCoK+Cy5b jXnazDOcOP072uZwJQKcOCcH5ModhKSaCUsv2GzO6Gx5WZY9tpkXDt1BG2tla/a5KvuamkbVARUC 1UiFzHKSr6HLbyo7T8jDzArJlq1dEksj612Sj/nJEiViAcChkg9GPUY7smUWz64mt8VHFATd77pE 1TtcJD7uhbrfvlkOKs+v8z+Uu5UZRAcRedPyBgnESrVPKUX2SYv9ycKM5UVNHLU7gOc/tDCQQ7Ol V1aP6D+M4CMfnhKFP7oiIVUTB7avQxhKiQHA8BSq0WDnqJDA1LAl6Pb4zC1okTcIno7qBp3a/qkE zriw91hanx+idTW2RTlZHkmpGU8VOdviZ9z12FKyh2bAxED+rKOiQ1I220pfp3TQlruzGaE3rZnw dSSb/ba7bt1fZudMXbem/7kG4l/mMaahN/Hm+d42bvGE1ncHjrP5gs20p5wGBdMY+IDkuHuU3oDY fFVE84vl43Eu9B+3/SwiAXEHC9YnijOox5b4wm6H6dpq+s1fEVMV7pdqftjl/NdBIgCX9hW6IU9y FgAov/Y2W4j+2bKuICQ2e+Mq8rOhYmLVGkc8kmY0+8YCowXFJYCvr/l61tfK1S3G65kTh7myo7eY eAEt4HrB0vA8Yc4FKUqqYqyF4oJigp7lsssVYyc/2iF9OR/TbCn+5viA9uI2K1TNL+fU3q/hoC/l inwf/B7pnq6Rbg==

Extracted

Path

  • C:\Program Files\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal id 3. We will decrypt 1 file for test(maximum file size - 2MG), it is guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help if third parties may cause increase price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: G9ixU0az5SF+XIC2wvHh2Pc/UjSDjYcP8pNI8lmK3idHSjmHCi+e3sO5xM3nV7wrFns4gOgBNNwA 9T0mQeu9CshiQ9J6OmqBdDHW1Nz/XZozoa+r/APwWO1rN+G3rfC5jQ8nY3M9zQ2FW6yqcov7pE+X e2KexDi9gg7jBCkLGhLUBK0FdpaI/5F5X8OBaMIwtYqAew6oVSvTKTNvKn8ynz6uObSUJlFRCVUD 7YO08YzXaW3hOtYoK83Zcyyw9c/CY8c1UXOqF185sm4DfMhLIvr2XskrJ6+pGXeMKLS6Gtubdx6e iDACkKN0KXQKqvhNibUAdIQisJ+0At1JN1XFqv1jCI/9BVxAj+TI3hnLuim/iECVkYitGoXODLPo 0BIe0+XCuKsqTJns9iut67XQxWVwjmpAcNJJChhzdFq1Er0cHImENCKS4zsVQoQnUuV7WiIjQM+T pE9/TRGLBwfbe4tjk8y7/kc8RMBv+OFl9TAwsOV7uzqSnnTx433RHSWMUFEuCVxDZfFqEgUD8L1A 5RaShW0+W2btdFrbIomOJ/GuPcZr6w8NgJEUbwnq0in31YT1NMmg9yR8uzAC4UUhfMAiGRKke+7e nq3wcqbmnxwd5MwuPD5NO5g/4PuoZT9htyCsPP5j7vVMlXy9GeaXSWEb4eft/iFfxAMT+pKwOj0y YHi7cz/3skg6Pzc8KaFW8ZE3kRrb4s41uAnFWPeMSx1UvHUcC/4PgTd9QiF4DjxgOPAm9fapaMrl piQWZP8aDwq8ViTHGfXFb26YRRu1EidWyTHkS0mEgZfOxWKZU/7wBqSQfeb82N2vUjgmop8pz3qi 21yWy9rPbxQdRkGGckhsOIG3KErXmk+6j2i76a97AtHhdcIXpT790HlBquXXOuKcOtzHbUyHMGSl tIVtNkhxPKKv9jiu+VIdn3uh0G2xUj+6/PW01/mFZBXQEi5xo6Zt4UjzQNx5SGU6uJTnjlmHU02O V7x+B6quKXeSmIm678H8bVUn0LG6Oa/hop+LWnJgcE8GHl10dNuCpwx7Pyb5oWVBW7hYyA3wRbEB YWkWVYwtEaxy5Nst++inTujGB7e8OHGRP+svgt50S1bi/6nhisLp63DS/lmTzM+AfMVnK9NQucqM 08aI7zrxxm9BYcrSkXa/hGOqcgAt3WLeF7ymA0T+rX23ckypBQXfAw1PkjT+TQRyF/m6cOGP1W6t myaJdyw4wWC/88dqRuWYYsxLQSwdodqfgYXbjqegWpl2znrVtwH2ZUeCmsxFrbQyw7FBc2rGTi3u RLEYehjuiqP/6kgVbZUcFF4foPPkY24t8zUDE/e2LyedYTFdeiNWFvWAbK8h8ckRfz9wgCvrjb88 f3FUe3xmiKF7RqEDDuRuNMiClvAgeCgBIzpTcFMGULs0t+gNSn4bTGqxk9fMoWXErtKsOxOziHXV w+P/yINf2D/pQpWfB30NjY4NvXH9OwPNs6Zsx6cDVA8GapX+2/A/DpP+ebqRANVAxG+5AyKUhDsz mePpthPNequr+BWsaBcTjGeTOacn98vPMktU2NARaWHi7HAD1LJhuoTsPki+lRO6Vr1WkkK9E6HY 3UrgfGNrUBb4r4RI9EmAUh8TQLZjs+F8NG3uc8TfnpTjUFfTDdYVFURkig+9l+3gvU1g935mbRk8 ojaF38bI6OeK52g/SbfpqH+RDuLkUQNpON7V7BnwAVC+PWJxPcOEJqTwSD+xlpmthfXu8wCoIwg/ LtvRHUedZ62HsqJ2ObCaMXNQYW+YPIhzz4xKNXWxtv08IM15INS2gGCFK9VpV5vWn1HTYBfsrVKg ujvgQpsOEJHLJ6hFmEEWL5OKcspz/leuDfQgWBgCtgHXSKmQQaMU2KH4pCoyI5MYXzGnGiCLxpP3 EBjksp5B+sRoBn1eYJDhT1pS6ZAetxQAcAxXT+PM9d3D6HbN0A80vojQx/EowGqEUQkRc3lotjMW HQISRe4GKNqoI/lDM6cAs1MnPYE7etdn+wl+7VzlY72T712e6RIux24w9A8BYsUJynZHQQQLnk3B tSnn6Ztcn3p8jCK8TWW3aUPUD5ujIZcBLQX2+EJ6TwAasSID3aQKcg/zhhRiUR251iBc0SMQ43Ik +GQGXxFzWuZ6uLJhguXRQRrKQ4gyymXt7OEmEpW60oPEy8eCWpYrFoX5fVvbmfCvvbPmnoKHVI/H ut7P+6p9EYPfirTTVjxMt2EZef8iVmprXNy7tE4DE/9JvMbZwelsqogUXRpapGVSn19hFmAfuqz6 JfnK7EunyXZ2yQEVS6nGKmpXjBJntz1zNZVZ1CK2ZvGT64FpbW5LxF6S5ZsiV7tVC5+dY9ZRBnb0 AthZopp48jSffpdcG7VMSgsizr7wimB5sJZoVJxP3QaG/pELmCTEvHbNKtl01ZEGuHBaNpFGmRxy a4VWUs9azdIUCKnP6mMf+pU3VQI4Wbn8yoi2o13toZhbnaTyxxfRUdlFihOCpGIYlbbznMjemQIn g496l8f2Wbv37o5YPTh2nkIlw4NzhYOys92vZpCFUvIhtU5E0ZDMovvtrvwD7SVEpYl/CtIr1oG2 EkXncH8U3b3oeEvp9oOMH5sEHHm/sae+NvIrN0AEDAHajaIR+Uv4jnnUF4erWPfcQxgHAzt9JRYY /+d4BZKicdRmWOAzR0/d2aaECA+DmNzp+8f1u8vN9yig7J3635rCInUmixU4SOvmRcJNy1x6O9rK l3OMJRx2QPPjp72mUUE6IrPsqPfqlDxFdBmV8OfCO2+33ZuLSWG7IRG1x96eHagYdXPSOdHo09qX nlcwiG6HUGJOUYcKZHfxOqWyA6PRY3X+sAYJUFa+NS+YkChkJlEqzs0QkPk7T9QOFutge/hZEFD4 P4yP7Qmk966wnQ==

Targets

    • Target
      6b03fddacd44cf7e1ba8ed899119a3b1e024f70670281589807cdd92c3314221.exe
    • Size 284KB
    • SHA256 6b03fddacd44cf7e1ba8ed899119a3b1e024f70670281589807cdd92c3314221
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryevasionexecutionlockbitimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

    • Family: Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies Windows Firewall

      defense_evasion

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks