Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 22:23
General
-
Target
LBB_PS1.ps1
-
Size
466KB
-
MD5
17a7cd1ead2d35ed5d69c71d4fd7386d
-
SHA1
734400d4444b88fe3848c80e3dba2ad9a5155c56
-
SHA256
20dd91f589ea77b84c8ed0f67bce837d1f4d7688e56754e709d467db0bea03c9
-
SHA512
7d5cd9b042229d1076a587b75594a002d379396d6ec889a8aee457a6a5a399130ae0a43fe0863adae23e32e46a7d17d4b55bfc2564cb17e579751161f6778828
-
SSDEEP
1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJI:VA
Malware Config
Signatures
-
Renames multiple (146) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LBB_PS1.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\LBB_PS1.ps12⤵
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BC89.tmp"C:\ProgramData\BC89.tmp"3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BC89.tmp >> NUL4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
1KB
MD5ca6e5843fe0f30068ddef94b0b542eca
SHA11527177e5ccfe0041918840613af104d2ba8a1c8
SHA2562655330566a9953364d9e13e939b3938e96a7b752d4f65f9586841b777ef137a
SHA5123296343e54290ae3c86d7f2deac6fe3e98a0b63428132aea9ae9b1d17805c7cadea183245e7ae9ee2d785430565989f0cd27a49600e7d8c61db66d151450b0e9
-
Filesize
466KB
MD5066172948f4c530fda2d01fe6e939426
SHA1479457112e79920e80e6812c7c8d8c50cbaaea5b
SHA256f0883de000ae2e09abb2c8f1a2525d5e0e06532739825d45591a5240f95932b8
SHA512cbca767b7f79ce39893c25f418bf3d3d3787d2fa41b7d26275a2049887b07d1227f42d462967f4591ffb2eeb88cdac642f58529abaf7a12d05e9ad02713ef1a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD530aea123931a176e4a10f7835c82ddf2
SHA15b47fe9616a40c70b2c96f5599cdc7de716c7764
SHA2567a4da77aecc6c82b498b546f94f0e609784ff1f8ded78db3be4125f442f8f679
SHA51274117c92bd0a3948684c8cadafd07673d0f8a63d4dfe68f96d36807a871309171d2d5095096bc8bb07e15471e7162a279eb37ebe6c13a648c37ac72d3e4bdd5f
-
Filesize
40KB
-
Filesize
140KB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
140KB
-
Filesize
7.7MB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
140KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
140KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB