Analysis
-
max time kernel
48s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-11-2022 18:23
Static task
static1
Behavioral task
behavioral1
Sample
hi.ps1
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
hi.ps1
Resource
win10v2004-20220812-en
General
-
Target
hi.ps1
-
Size
1.5MB
-
MD5
a89167e3878eb3c1d77e6aa0503eb108
-
SHA1
7a377cbacdb226209e4a0b8e266183c344707275
-
SHA256
a497aca3c4321e9ed7b437aca33b823a5905b1a6dcc0e52da8f5a5ad38ef48d7
-
SHA512
33272d9bd5557ec18cbddec936f040460c69b94421f60fcf0eb0b1e52a439207e2fc60e8dcd09b93ad789cdc633f80403ccfd9d3f1f4cd47387f111658ef901d
-
SSDEEP
24576:mC8RxPoWBiohwATmAvDVu8XrP+H9AXa9rh:GRZJ1Pm8ZA
Malware Config
Extracted
C:\8Fp4QiPet.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
powershell.exepid process 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe -
Modifies registry class 5 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\8Fp4QiPet powershell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\8Fp4QiPet\DefaultIcon\ = "C:\\ProgramData\\8Fp4QiPet.ico" powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.8Fp4QiPet powershell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.8Fp4QiPet\ = "8Fp4QiPet" powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\8Fp4QiPet\DefaultIcon powershell.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepid process 1720 powershell.exe 1720 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1636 powershell.exe Token: SeBackupPrivilege 1636 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: 36 1636 powershell.exe Token: SeImpersonatePrivilege 1636 powershell.exe Token: SeIncBasePriorityPrivilege 1636 powershell.exe Token: SeIncreaseQuotaPrivilege 1636 powershell.exe Token: 33 1636 powershell.exe Token: SeManageVolumePrivilege 1636 powershell.exe Token: SeProfSingleProcessPrivilege 1636 powershell.exe Token: SeRestorePrivilege 1636 powershell.exe Token: SeSecurityPrivilege 1636 powershell.exe Token: SeSystemProfilePrivilege 1636 powershell.exe Token: SeTakeOwnershipPrivilege 1636 powershell.exe Token: SeShutdownPrivilege 1636 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeBackupPrivilege 1636 powershell.exe Token: SeBackupPrivilege 1636 powershell.exe Token: SeSecurityPrivilege 1636 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
powershell.exedescription pid process target process PID 1720 wrote to memory of 1636 1720 powershell.exe powershell.exe PID 1720 wrote to memory of 1636 1720 powershell.exe powershell.exe PID 1720 wrote to memory of 1636 1720 powershell.exe powershell.exe PID 1720 wrote to memory of 1636 1720 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\hi.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\hi.ps12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-