File name: | lockbit |
Full analysis: | https://app.any.run/tasks/d3c537cf-67af-4f8f-99d7-ac4291f29028 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 00:55:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 96DE05212B30EC85D4CF03386C1B84AF |
SHA1: | DBE5243C6EA5CC4CFB3EDF042BD94A59CF9A0E64 |
SHA256: | 00260C390FFAB5734208A7199DF0E4229A76261C3F5B7264C4515ACB8EB9C2F8 |
SSDEEP: | 24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q9F:dAfSrWW4g+7Ht+UmxJe6 |
.dll | | | Win32 Dynamic Link Library (generic) (43.5) |
---|---|---|
.exe | | | Win32 Executable (generic) (29.8) |
.exe | | | Generic Win/DOS Executable (13.2) |
.exe | | | DOS Executable Generic (13.2) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2021-Jul-09 14:54:27 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 216 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 2 |
TimeDateStamp: | 2021-Jul-09 14:54:27 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 823283 | 823296 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.59832 |
.data | 827392 | 93460 | 58880 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.77639 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
560 | "C:\Users\admin\AppData\Local\Temp\lockbit.exe" | C:\Users\admin\AppData\Local\Temp\lockbit.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
2096 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3568 | C:\Windows\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2736 | "C:\Users\admin\AppData\Local\Temp\lockbit.exe" | C:\Users\admin\AppData\Local\Temp\lockbit.exe | DllHost.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
2276 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3160 | "C:\Users\admin\AppData\Local\Temp\lockbit.exe" | C:\Users\admin\AppData\Local\Temp\lockbit.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
4036 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2904 | C:\Windows\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1332 | "C:\Users\admin\AppData\Local\Temp\lockbit.exe" | C:\Users\admin\AppData\Local\Temp\lockbit.exe | — | DllHost.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
2412 | "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no | C:\Windows\System32\cmd.exe | — | lockbit.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|
(PID) Process: | (2096) DllHost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\Calibration |
Operation: | write | Name: | DisplayCalibrator |
Value: C:\Users\admin\AppData\Local\Temp\lockbit.exe | |||
(PID) Process: | (3568) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3568) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3568) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3568) DllHost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2736) lockbit.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | {AD2359D3-E3E3-40C5-BF5C-BFBC1DD0BDA} |
Value: "C:\Users\admin\AppData\Local\Temp\lockbit.exe" | |||
(PID) Process: | (2736) lockbit.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon |
Operation: | write | Name: | (default) |
Value: C:\windows\system32\172375.ico | |||
(PID) Process: | (2736) lockbit.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
Operation: | write | Name: | GlobalAssocChangedCounter |
Value: 101 | |||
(PID) Process: | (2736) lockbit.exe | Key: | HKEY_CURRENT_USER\Software\172375D3E3B45C |
Operation: | write | Name: | Private |
Value: 0DDB15CE38A80E5D800A56AE009F2931230460BA56CDB681C12EE0DFDA617703D075DB32D9E4B60BC10CC265DE58649B993CD9DE9C2048B4D8AA6731BE2B297EAE7DDF0DB53E7059C8E7121775B7774C0F1CCD85DE075FF30E29E76F3ABA4BCF9BBAFED4758878384B0F9C17CAB05072 | |||
(PID) Process: | (2736) lockbit.exe | Key: | HKEY_CURRENT_USER\Software\172375D3E3B45C |
Operation: | write | Name: | Public |
Value: A41164347761DF6688B88D49912AB7C1F61B42AF54754C84381BF178FEC6F20D |
PID | Process | Filename | Type | |
---|---|---|---|---|
2736 | lockbit.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\accessibility_r_rhp.aapp.lockbit | binary | |
MD5:BE33E33FF07D8C88409E487871B2FFE9 | SHA256:756AAFC7D3CBF30F2291F221673B40FDA89366A4AA6ABED562625F99352A66F6 | |||
2736 | lockbit.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\actions_r_rhp.aapp.lockbit | binary | |
MD5:51EA4F2CB356B1CB16C17D6B4E6DC35F | SHA256:62D8CF609A61B5293B0A98F771AF4DF0E40ACE35DF0778501B9E9B9815086E5B | |||
2736 | lockbit.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\appcenter_r.aapp.lockbit | binary | |
MD5:585DB224F8F631017C32734C7F2AD7C2 | SHA256:523BF88EB97003B569371FD27AEF6253EE9C1B1CA2339DFFE6FE42745D879749 | |||
2736 | lockbit.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\certificates_r.aapp.lockbit | binary | |
MD5:23781BE95B2CA1236AB21A542545EBB3 | SHA256:511C38236807C86751D4046EADF8BA004583662621D974D1FDC762D1A7BB9E1B | |||
2736 | lockbit.exe | C:\program files\adobe\acrobat reader dc\reader\Restore-My-Files.txt | text | |
MD5:9883FB245D025985775344E9F30E9963 | SHA256:C5EEA25EDD67312BF026EA4B77AFB1EE236558364FE5FCA6AD8A454C10C14AE4 | |||
2736 | lockbit.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.lockbit | binary | |
MD5:FDFC7D2FE6C6D3457651D2C798DF24DD | SHA256:1CA909ADB448C5BFC0F2F620456E0E3BF35C9BA406DD4D7398771221CB1EA581 | |||
2736 | lockbit.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\combine_r_rhp.aapp.lockbit | binary | |
MD5:1F96E2E9C1EF3688F5F32924E91F8D51 | SHA256:D17B2C1DF66379C4075EFC4BEA22A64D12FC51E7F30C90DECF48D3580FC24D40 | |||
2736 | lockbit.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\collectsignatures.aapp.lockbit | binary | |
MD5:FFF68F7C9F7E975F9B023F4185D5630D | SHA256:DBB802E72BF448AAFA163058AA98936188E675F3AFEE672F7FA236FF7DDE6C40 | |||
2736 | lockbit.exe | C:\program files\adobe\acrobat reader dc\reader\acroapp\enu\appcenter_r.aapp | binary | |
MD5:585DB224F8F631017C32734C7F2AD7C2 | SHA256:523BF88EB97003B569371FD27AEF6253EE9C1B1CA2339DFFE6FE42745D879749 | |||
2736 | lockbit.exe | C:\program files\adobe\acrobat reader dc\reader\acroapp\enu\collectsignatures.aapp | binary | |
MD5:FFF68F7C9F7E975F9B023F4185D5630D | SHA256:DBB802E72BF448AAFA163058AA98936188E675F3AFEE672F7FA236FF7DDE6C40 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 192.168.100.1:445 | — | — | — | unknown |
— | — | 192.168.100.2:135 | — | — | — | whitelisted |
— | — | 192.168.100.1:135 | — | — | — | unknown |
— | — | 192.168.100.2:445 | — | — | — | whitelisted |