Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 22:25

General

  • Target

    LBB_PS1.ps1

  • Size

    466KB

  • MD5

    17a7cd1ead2d35ed5d69c71d4fd7386d

  • SHA1

    734400d4444b88fe3848c80e3dba2ad9a5155c56

  • SHA256

    20dd91f589ea77b84c8ed0f67bce837d1f4d7688e56754e709d467db0bea03c9

  • SHA512

    7d5cd9b042229d1076a587b75594a002d379396d6ec889a8aee457a6a5a399130ae0a43fe0863adae23e32e46a7d17d4b55bfc2564cb17e579751161f6778828

  • SSDEEP

    1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJI:VA

Malware Config

Signatures

  • Renames multiple (144) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LBB_PS1.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\LBB_PS1.ps1
      2⤵
      • Sets desktop wallpaper using registry
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\ProgramData\99FE.tmp
        "C:\ProgramData\99FE.tmp"
        3⤵
        • Checks computer location settings
        • Deletes itself
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:4516
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\99FE.tmp >> NUL
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1036
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:3844

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\99FE.tmp

      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      9e45e784e2d640c1aa8a549678d2a7d3

      SHA1

      621289ba2924275a478803b174eb2c83e5776dea

      SHA256

      d3025c9eba17f1dc87204c5a61e53ad8d6850aeff328ad7586745101e2dc591d

      SHA512

      cba024347d760ec5f14dde94bac54cc744af081b4e0aa0e9854f2943a6532e6dec950081326cbbaea41c4606fba671b54b098e43f02a49a381648fc004b65bd9

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDD

      Filesize

      466KB

      MD5

      d81ba43d6f85caf230b51ef90e424f1a

      SHA1

      c487db3153a16478dadcca4708754f5beefe225a

      SHA256

      a41fae823e1fa0ded76673fe9aaa424d5e52f88cd4df9090142d71660e5f4518

      SHA512

      03ac4d37f0cc920337295498bc5327337b7cdcf1484cd4885bc2dd1d8664b4e3ea09e35fe50e5ee4446e3a7c2e419df2e53374b046d1bdb3e23a5c7ee6250419

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uufrgfh1.bpr.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • F:\kF0wnCN24.README.txt

      Filesize

      6KB

      MD5

      fc008dd1107e091d6c57828cc685bf80

      SHA1

      46ad09041b2a897b3395672553d5befab84172fa

      SHA256

      5310562f473a406337f469211ac33464989a613bf1bfc4d5eb4d440abbfdb484

      SHA512

      16d311ff056719c45c92c0efd4407eb845b83bff4a04e66a63ac8a30da1113ad6aa737ca3b4093a0be8de9458282d400560db8a6bd7dd889615c9de655d09eea

    • memory/2204-0-0x00007FFDD2E43000-0x00007FFDD2E45000-memory.dmp

      Filesize

      8KB

    • memory/2204-6-0x0000027E903B0000-0x0000027E903D2000-memory.dmp

      Filesize

      136KB

    • memory/2204-11-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

      Filesize

      10.8MB

    • memory/2204-12-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

      Filesize

      10.8MB

    • memory/2204-13-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

      Filesize

      10.8MB

    • memory/2204-16-0x00007FFDD2E40000-0x00007FFDD3901000-memory.dmp

      Filesize

      10.8MB

    • memory/2416-42-0x0000000070340000-0x000000007038C000-memory.dmp

      Filesize

      304KB

    • memory/2416-57-0x0000000007E70000-0x0000000007F06000-memory.dmp

      Filesize

      600KB

    • memory/2416-20-0x00000000058C0000-0x0000000005EE8000-memory.dmp

      Filesize

      6.2MB

    • memory/2416-19-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-21-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-22-0x0000000005830000-0x0000000005852000-memory.dmp

      Filesize

      136KB

    • memory/2416-23-0x0000000006060000-0x00000000060C6000-memory.dmp

      Filesize

      408KB

    • memory/2416-24-0x00000000060D0000-0x0000000006136000-memory.dmp

      Filesize

      408KB

    • memory/2416-30-0x0000000006210000-0x0000000006564000-memory.dmp

      Filesize

      3.3MB

    • memory/2416-36-0x0000000006810000-0x000000000682E000-memory.dmp

      Filesize

      120KB

    • memory/2416-37-0x00000000068A0000-0x00000000068EC000-memory.dmp

      Filesize

      304KB

    • memory/2416-38-0x0000000007FB0000-0x000000000862A000-memory.dmp

      Filesize

      6.5MB

    • memory/2416-39-0x0000000006D90000-0x0000000006DAA000-memory.dmp

      Filesize

      104KB

    • memory/2416-43-0x0000000070AE0000-0x0000000070E34000-memory.dmp

      Filesize

      3.3MB

    • memory/2416-53-0x0000000007890000-0x00000000078AE000-memory.dmp

      Filesize

      120KB

    • memory/2416-17-0x000000007452E000-0x000000007452F000-memory.dmp

      Filesize

      4KB

    • memory/2416-54-0x0000000007B30000-0x0000000007BD3000-memory.dmp

      Filesize

      652KB

    • memory/2416-41-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-55-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-40-0x00000000078D0000-0x0000000007902000-memory.dmp

      Filesize

      200KB

    • memory/2416-56-0x0000000007C30000-0x0000000007C3A000-memory.dmp

      Filesize

      40KB

    • memory/2416-18-0x0000000005250000-0x0000000005286000-memory.dmp

      Filesize

      216KB

    • memory/2416-58-0x0000000007D80000-0x0000000007D91000-memory.dmp

      Filesize

      68KB

    • memory/2416-59-0x0000000007DB0000-0x0000000007DBE000-memory.dmp

      Filesize

      56KB

    • memory/2416-60-0x0000000007DD0000-0x0000000007DE4000-memory.dmp

      Filesize

      80KB

    • memory/2416-62-0x0000000007E10000-0x0000000007E18000-memory.dmp

      Filesize

      32KB

    • memory/2416-61-0x0000000007E20000-0x0000000007E3A000-memory.dmp

      Filesize

      104KB

    • memory/2416-63-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-69-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-71-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-75-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-77-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-96-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-82-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-304-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-302-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-308-0x000000007452E000-0x000000007452F000-memory.dmp

      Filesize

      4KB

    • memory/2416-309-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-310-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

    • memory/2416-311-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-317-0x0000000008650000-0x0000000008673000-memory.dmp

      Filesize

      140KB

    • memory/2416-320-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB