lockbit

General

Target

33f44527100ab0e940ac9d10664cc70eda7285c4491c1b26acc4f96cccc4d96d
Size

1.5MB
Sample

240613-1cewnavbkr
MD5

862070f88be9b53009fadec1f3c4455b
SHA1

51693d87e8ac936ded1131279372956c59644ba3
SHA256

33f44527100ab0e940ac9d10664cc70eda7285c4491c1b26acc4f96cccc4d96d
SHA512

26d2411866046541ceff11bd8fa0ba8c1e7ac461bee65496608ae904c758708de76410570e46bb45930953372056b739e47ed442db9e325fd15754b7976fd034
SSDEEP

24576:lI8tXzEMohhJjvT+QPSBx5fCi6yX6N/9XSiOMEYAV20FZMTDH8W:lI89oMuaQPSBxpF6yX6N/dS1MEYAjZmt

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 0A432444583F02A482BA8BFD5CB140C2

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Targets

- Target
  
  33f44527100ab0e940ac9d10664cc70eda7285c4491c1b26acc4f96cccc4d96d
- Size
  
  1.5MB
- MD5
  
  862070f88be9b53009fadec1f3c4455b
- SHA1
  
  51693d87e8ac936ded1131279372956c59644ba3
- SHA256
  
  33f44527100ab0e940ac9d10664cc70eda7285c4491c1b26acc4f96cccc4d96d
- SHA512
  
  26d2411866046541ceff11bd8fa0ba8c1e7ac461bee65496608ae904c758708de76410570e46bb45930953372056b739e47ed442db9e325fd15754b7976fd034
- SSDEEP
  
  24576:lI8tXzEMohhJjvT+QPSBx5fCi6yX6N/9XSiOMEYAV20FZMTDH8W:lI89oMuaQPSBxpF6yX6N/dS1MEYAjZmt
Score

10^/10

lockbit defense_evasion discovery evasion execution impact persistence ransomware upx
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware
- Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
- Modifies boot configuration data using bcdedit
  ransomware evasion
- UPX dump on OEP (original entry point)
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  1c8b2b40c642e8b5a5b3ff102796fb37
- SHA1
  
  3245f55afac50f775eb53fd6d14abb7fe523393d
- SHA256
  
  8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
- SHA512
  
  4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
- SSDEEP
  
  96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
Score

3^/10
behavioral5 behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Creates a large amount of network flows

Deletes shadow copies

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Modifies boot configuration data using bcdedit

UPX dump on OEP (original entry point)

Loads dropped DLL

UPX packed file

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6