Extracted

• • Target
    2026-07-20_b0c4fe17a83df1621ce3db824684bb55_elex_lockbit_phorpiex
  • Size 17KB
  • SHA256 2ac492ce3b66a7979ceba5f26c594f0a69698d19b2ffdb56ac8b741dc30f8e5e
  • MD5 b0c4fe17a83df1621ce3db824684bb55
  • SHA1 5a8031f3c9ff3c65ebaa0aa60f9e59feba83c71c
  • SHA512 17cd909753c115693acb77acfbe27e08d5e10e7b1ce7f4c91985d6031b9fbf4f14542d0507cdc81f14e9fcf72841db670ba48677bfe8666f4375f15f22af2fc7
  • SSDEEP 384:KV88In4z+hDTXJMQWSc7BLs1QuCm6Ee9nlAnXX5GMLWV:I8Tny+hvaQENs1Qum3O7LW
  • TLSH
    T1C1728D07EE959212E3E44CB401719B5F067F587333A6A2DFF373660A6F747504920AAB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverylockbitphorphiexloaderpersistenceransomwarespywarestealertrojanworm

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • Renames multiple (1006) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2