Overview

overview

10

Static

static

3

a0adbb5726...de.exe

windows10-2004-x64

10

a0adbb5726...de.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a0adbb57264ffd5b728b19b8217ae80ba073a0a440978dde87466ba81ef668de.exe
  • Size 380KB
  • Sample260703-txf6wscy2z
  • SHA256 a0adbb57264ffd5b728b19b8217ae80ba073a0a440978dde87466ba81ef668de
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lockbitramnitadwarebankercredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal id 3. We will decrypt 1 file for test(maximum file size - 2MG), it is guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help if third parties may cause increase price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: qCBiWi9xVOnbxV2bAuTVOx823cZOgfEGSiZ9WNGJii/BcvyAxENKTSeYsnw3MFA0h/Im8XbhiDQZ rzYcNAHTJRXfAX5MqBYID071OuH08bBDwH9cfzCfqzJO5VV5AXP2jUjLlbA3yNsrRWJmwwtMBvoE 5g6GUYSk6eC6ALEKpTahQzhTQ3Zjm4h8ZSMgXdmzCGFEUZgO7wRJ95ctH2lxMvnEecjw78tfm1Ij pFP+b5OCj+FN9WkFoo8Igs/1EJLWBgrQKT4aWYXRMEUmDbV/38S/m82Wjt7NyJBXNbB/bxjcxH9x aAoIUypdbbCIl4Ry/VRt2eEu2xddUHaihESZ70LAUgbhnrL8R2nJO2Qkry67orNu9iWEcX8/0OSO 1clxms++gyJVTxPWqP9lyJjES4AvAnik4HRUnlOLiBn5DZRLxXLuHJ8ZdtHVJrSm4+oRZFoi+jdx /jo9rexpjW2BNDD+4qgmIqLoZ5h7zEFgcdqB1KHm7hxdCyO03nnzHNuIroxuSJtPQlYsmjlR+9II HMfwyu1tVDjTQMzoYGzimAh9u1Eupm9kAh2JtZp2O4BF0tQALeyKCg9rtz1zuetlPo7AnBB77pE+ uePa+qCjdRyhM8o/28jC1rCr+h8MJGetGrG+MOusszQoU7mJNpf5hceRYYjMKmIzo52YZSbzcTAI B5JCKmOB+UcpnLfauDAoCidjUXMmmRp4+i6CHKL/ux8WQe9GPF5YpY7Oa690er2OJ8cCkEeYXod2 gvuxYoeq+a9js3VN0W/jXmwMdfy8GNpBu0asFYfzYmd4Ndn1xr7LEA3UYUbAbrDHZqwh8dXLcLk0 i2YwCDhTQSedY57rS44tCsOxcyPqusevUwSkiGotBdV7DvVEbMy/qAMBNeB/fGY8KB9jYCTn+kwv 6UwiHT2neAtuA8Wq7DdvcyL/NpA+qJnVbXjaWqTWvynrkLPKywXog3iuecolHvLwGqkjM60TLPkl HgJZvY3xQk0hd312nKYbFwgrjDGJumG94GD3Due4rYjvj0e0lu/FVBoM0Y+zI1j94cfKT1r4mf6+ lodXKbV8L/YcinI0SlJLuSrughwRDqA6f2pJX4oXuNbSlKv3CSE5/hiXyaJpTzhmIwk5nrq3iqj4 3F62TxtgEnigeCyaO0LzB8QojzdSTHGMnHr9yrmknmgJZxieEwaykk8oPde9m9Y3vMm/Lkd185pa N/1oB00ZsoFcoxiwAYUS9u6ImNsD4WkxtVqt+bwUxWTidckgwsZmZbLU7Y6Riv0cUF0KJpVLbK4N KUSk2HSrFWrMFYkWz0jsPJp2GXCWa7rjkSrhfGRZ80qsla90fc+mEPHcz0ZdRq0q9lCh8EQw80CQ lKvdS3BIb3CQ8hlEH36oOOEvrUQNXbMlCBF599gP8eNk0IUAxungyxcgx+MJSTm4Bz/tF+lgwzWk JNJGqoPbLG55nMkN1nzUDcGhTEkst96q8igWUdZiuypPDGKfj6JT+AGD2srvYOVdKfxCHRGOG8tj Pxsa795vQYPaLL8YXIMfzoEr5WUaDSKEDJh2O+dA/uvBpXdnxWK2ITLrkCqMk/hpnB/UBTmtdDoH CwfArwlW9RQi009N/pVXYbSdKF8r+8PiZuCu9cS7KcMyiFzLl/fd+m1BIqD6/p/aVDdKtgBppn8+ LRqPziZmzSffzkVrN/fjaRvyaQ1JAe3nBYyqknZmVQRI0+kYE05SD5SPYf4JbrgyJ/pigTGGBZqs RvRrK5Bx7Q4hUgfLrGsv81M02vpMyBGcVNtSXgFP6R59QfSisFOlXUch2Fwt9UmMo5Qo7rlo7Q/w JsSY0brl1sjIA0+vW7EMQ6PqaJQf5Q0HpKK1JaRr4mORxMRpmyUtYc5hXAFqh7FRH89PddKk6E2j 8DkFMiQRcgWi7hoz6kVhqJ6sIj6C143tml5hAcY4mLoRgn5q0xLSlm4Xt1mAqQDMpL//PQ0nlRzK qmizeEQrdDWWSvxifSYjiNe6m/d0qamz5vNGcc1v0RfRA5D4Tc+vbYwkXEQRUnQn6m7eRWUMLSzO dD0eBoj97rjXZGFBtSZXrtt4KhvTO9KRt9y6qzVfF1PmtNaU/fCzZ1M0cwvwpGUzG4TSh6+h1tnL a9Hxc6Aex8MieYLZYP+/Z71BztWUs6Yv889qh5SgEcT81WkmMu3dEKJhnIkGhKiRf27bFiqMUbBv HO+rpOT2cdkP5FkYEad7QJyGVmmu2E4T/vMdBV1VOqG7NoTZWXHo9M664w9k9nD1701cdwvyUaEk VCjUmGkORSBAhR3KAKaAbyY2AC2TVV5PtlsNQV22fT7TGfRLaI/APPiyzRc3pA0FG99DbKYDrzVy MuOgwS38pErbCV9H7H/p7BoB1QyGrB7eVaRpVpQ+FxbpgBAKzBn0YEF+80dBOCiQ1EqARvs17beC hoiRGxMafyEQ+BUrKFx2avC1IprFClZN34IeuMYqJDS59bGmOk4vd10A/4TkKBXw58f4m7pG7sAf SZbQS/RszJELp8ih0MxdeRPTX/Kpzke2QWbjvvgBQIcNexgyTSHxBT8wxYrjKgLkyJYkry5hoxZT s6dq3xqJ1QgHB2G3JGsH1K7sxpbBsMYvfdBz06iWqxo1+/460muUNta5u9+AbdK9c955yemEP86D QbkItNEkADzJstwWt81E32BY2bqH1IqceDTX1ZOuArMnFdLxXkR41sBvOrVYHBL57GVQ/w7V/dr8 v5OfvbRTiG91w5g08T9m0/fxvctcU8wQnIhRzT4h0uxUCysbKr0V0pM8mDG1DpDOl0cnCAVcrfas tqzkZzf0xiPbSsqH1jXWrjxHHeVArllCtusCmUvLN7awrdgPjBFw/2SQfSHjfMfY5vCnePa3eGxw F7hK4AYNyUFaZQ==

Targets

    • Target
      a0adbb57264ffd5b728b19b8217ae80ba073a0a440978dde87466ba81ef668de.exe
    • Size 380KB
    • SHA256 a0adbb57264ffd5b728b19b8217ae80ba073a0a440978dde87466ba81ef668de
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarebankercredential_accessdefense_evasiondiscoveryevasionexecutionlockbitramnitimpactpersistenceprivilege_escalationransomwarespywarestealertrojanupxworm

    • Family: Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Family: Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies Windows Firewall

      defense_evasion

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks