Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7 -
submitted
19-06-2020 17:58
Static task
static1
Behavioral task
behavioral1
Sample
Lockbit.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
Lockbit.bin.exe
Resource
win10
General
-
Target
Lockbit.bin.exe
-
Size
101KB
-
MD5
889328e2cf5f5d74531b9b0a25c1871c
-
SHA1
d14a6e699a1f0805bd1248c80c2dc9dfccf0f403
-
SHA256
0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f
-
SHA512
f14ed75d97d2cd7e351f3cf75f9f374c2e9e388a1f5855a478d50b098b1250a67e375bdbd193b24d00bc052e0b3f8018cb3e74760be8c40b860be9f3d0ba2493
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBCEB996649AC036A0
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2780 cmd.exe -
Enumerates connected drives 3 TTPs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Lockbit.bin.exepid process 1156 Lockbit.bin.exe -
Processes:
wbadmin.exepid process 1548 wbadmin.exe -
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes system backup catalog 2 TTPs
Ransomware often tries to delete backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
Lockbit.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B3F3.tmp.bmp" Lockbit.bin.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Lockbit.bin.execmd.execmd.exedescription pid process target process PID 1156 wrote to memory of 1500 1156 Lockbit.bin.exe cmd.exe PID 1156 wrote to memory of 1500 1156 Lockbit.bin.exe cmd.exe PID 1156 wrote to memory of 1500 1156 Lockbit.bin.exe cmd.exe PID 1156 wrote to memory of 1500 1156 Lockbit.bin.exe cmd.exe PID 1500 wrote to memory of 1820 1500 cmd.exe vssadmin.exe PID 1500 wrote to memory of 1820 1500 cmd.exe vssadmin.exe PID 1500 wrote to memory of 1820 1500 cmd.exe vssadmin.exe PID 1500 wrote to memory of 1868 1500 cmd.exe WMIC.exe PID 1500 wrote to memory of 1868 1500 cmd.exe WMIC.exe PID 1500 wrote to memory of 1868 1500 cmd.exe WMIC.exe PID 1500 wrote to memory of 1628 1500 cmd.exe bcdedit.exe PID 1500 wrote to memory of 1628 1500 cmd.exe bcdedit.exe PID 1500 wrote to memory of 1628 1500 cmd.exe bcdedit.exe PID 1500 wrote to memory of 1664 1500 cmd.exe bcdedit.exe PID 1500 wrote to memory of 1664 1500 cmd.exe bcdedit.exe PID 1500 wrote to memory of 1664 1500 cmd.exe bcdedit.exe PID 1500 wrote to memory of 1548 1500 cmd.exe wbadmin.exe PID 1500 wrote to memory of 1548 1500 cmd.exe wbadmin.exe PID 1500 wrote to memory of 1548 1500 cmd.exe wbadmin.exe PID 1156 wrote to memory of 2780 1156 Lockbit.bin.exe cmd.exe PID 1156 wrote to memory of 2780 1156 Lockbit.bin.exe cmd.exe PID 1156 wrote to memory of 2780 1156 Lockbit.bin.exe cmd.exe PID 1156 wrote to memory of 2780 1156 Lockbit.bin.exe cmd.exe PID 2780 wrote to memory of 2812 2780 cmd.exe PING.EXE PID 2780 wrote to memory of 2812 2780 cmd.exe PING.EXE PID 2780 wrote to memory of 2812 2780 cmd.exe PING.EXE PID 2780 wrote to memory of 2812 2780 cmd.exe PING.EXE -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1628 bcdedit.exe 1664 bcdedit.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1820 vssadmin.exe -
Modifies control panel 2 IoCs
Processes:
Lockbit.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\WallpaperStyle = "2" Lockbit.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\TileWallpaper = "0" Lockbit.bin.exe -
Drops file in Program Files directory 9676 IoCs
Processes:
Lockbit.bin.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE05710_.WMF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102002.WMF.lockbit Lockbit.bin.exe File created C:\Program Files\Microsoft Office\Office14\ADDINS\Restore-My-Files.txt Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18254_.WMF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WZCNFLCT.CHM.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02227_.WMF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png.lockbit Lockbit.bin.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\Restore-My-Files.txt Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Doc.css.lockbit Lockbit.bin.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\Restore-My-Files.txt Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg.lockbit Lockbit.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\Restore-My-Files.txt Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\GIFT.XML.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01843_.GIF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.lockbit Lockbit.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\Restore-My-Files.txt Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRAPH_COL.HXC.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageSlice.gif.lockbit Lockbit.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip.lockbit Lockbit.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0298897.WMF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ReviewRouting_Init.xsn.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.lockbit Lockbit.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full.png.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107516.WMF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.DEV.HXS.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART6.BDR.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\EMAIL.XML.lockbit Lockbit.bin.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\Restore-My-Files.txt Lockbit.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm Lockbit.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt.lockbit Lockbit.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.lockbit Lockbit.bin.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
Lockbit.bin.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 1156 Lockbit.bin.exe Token: SeBackupPrivilege 1788 vssvc.exe Token: SeRestorePrivilege 1788 vssvc.exe Token: SeAuditPrivilege 1788 vssvc.exe Token: SeTakeOwnershipPrivilege 1156 Lockbit.bin.exe Token: SeIncreaseQuotaPrivilege 1868 WMIC.exe Token: SeSecurityPrivilege 1868 WMIC.exe Token: SeTakeOwnershipPrivilege 1868 WMIC.exe Token: SeLoadDriverPrivilege 1868 WMIC.exe Token: SeSystemProfilePrivilege 1868 WMIC.exe Token: SeSystemtimePrivilege 1868 WMIC.exe Token: SeProfSingleProcessPrivilege 1868 WMIC.exe Token: SeIncBasePriorityPrivilege 1868 WMIC.exe Token: SeCreatePagefilePrivilege 1868 WMIC.exe Token: SeBackupPrivilege 1868 WMIC.exe Token: SeRestorePrivilege 1868 WMIC.exe Token: SeShutdownPrivilege 1868 WMIC.exe Token: SeDebugPrivilege 1868 WMIC.exe Token: SeSystemEnvironmentPrivilege 1868 WMIC.exe Token: SeRemoteShutdownPrivilege 1868 WMIC.exe Token: SeUndockPrivilege 1868 WMIC.exe Token: SeManageVolumePrivilege 1868 WMIC.exe Token: 33 1868 WMIC.exe Token: 34 1868 WMIC.exe Token: 35 1868 WMIC.exe Token: SeIncreaseQuotaPrivilege 1868 WMIC.exe Token: SeSecurityPrivilege 1868 WMIC.exe Token: SeTakeOwnershipPrivilege 1868 WMIC.exe Token: SeLoadDriverPrivilege 1868 WMIC.exe Token: SeSystemProfilePrivilege 1868 WMIC.exe Token: SeSystemtimePrivilege 1868 WMIC.exe Token: SeProfSingleProcessPrivilege 1868 WMIC.exe Token: SeIncBasePriorityPrivilege 1868 WMIC.exe Token: SeCreatePagefilePrivilege 1868 WMIC.exe Token: SeBackupPrivilege 1868 WMIC.exe Token: SeRestorePrivilege 1868 WMIC.exe Token: SeShutdownPrivilege 1868 WMIC.exe Token: SeDebugPrivilege 1868 WMIC.exe Token: SeSystemEnvironmentPrivilege 1868 WMIC.exe Token: SeRemoteShutdownPrivilege 1868 WMIC.exe Token: SeUndockPrivilege 1868 WMIC.exe Token: SeManageVolumePrivilege 1868 WMIC.exe Token: 33 1868 WMIC.exe Token: 34 1868 WMIC.exe Token: 35 1868 WMIC.exe Token: SeBackupPrivilege 2028 wbengine.exe Token: SeRestorePrivilege 2028 wbengine.exe Token: SeSecurityPrivilege 2028 wbengine.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
Lockbit.bin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Lockbit.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C\"" Lockbit.bin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lockbit.bin.exe"C:\Users\Admin\AppData\Local\Temp\Lockbit.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Modifies control panel
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 20 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Lockbit.bin.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 203⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-0-0x0000000000000000-mapping.dmp
-
memory/1548-5-0x0000000000000000-mapping.dmp
-
memory/1628-3-0x0000000000000000-mapping.dmp
-
memory/1664-4-0x0000000000000000-mapping.dmp
-
memory/1820-1-0x0000000000000000-mapping.dmp
-
memory/1868-2-0x0000000000000000-mapping.dmp
-
memory/2780-6-0x0000000000000000-mapping.dmp
-
memory/2812-7-0x0000000000000000-mapping.dmp