Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 11:33
Static task
static1
Behavioral task
behavioral1
Sample
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
Resource
win10v2004-20241007-en
General
-
Target
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
-
Size
590KB
-
MD5
e0411fcbbff0e20922d224c3ac8c811e
-
SHA1
1083bc3407717b9953ffe27ec8ef3f0a520fbc82
-
SHA256
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527
-
SHA512
0555dbe49cc4ac2e432b85e847ac48113d74651f8c238329645b1bb07968d3418e92122b7750a3902793824a932647fe5c27c1c3e841a010a354d789c358eba3
-
SSDEEP
1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJt:cA
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule behavioral1/memory/1300-14-0x0000000010000000-0x0000000010022000-memory.dmp family_lockbit -
pid Process 2328 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2328 powershell.exe 2328 powershell.exe 2328 powershell.exe 1300 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2328 powershell.exe Token: SeDebugPrivilege 1300 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1300 2328 powershell.exe 32 PID 2328 wrote to memory of 1300 2328 powershell.exe 32 PID 2328 wrote to memory of 1300 2328 powershell.exe 32 PID 2328 wrote to memory of 1300 2328 powershell.exe 32 PID 1300 wrote to memory of 2656 1300 powershell.exe 34 PID 1300 wrote to memory of 2656 1300 powershell.exe 34 PID 1300 wrote to memory of 2656 1300 powershell.exe 34 PID 1300 wrote to memory of 2656 1300 powershell.exe 34
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "1300" "964"3⤵
- System Location Discovery: System Language Discovery
PID:2656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57b3fcc6bd61a97159d3c7f86baa21e55
SHA119f809deed61312a64b437e17314817666f5e38c
SHA256cd02e5b3c499603ae3354f9e5cc2658a4289048aa89504ff649dd4901377a249
SHA512a135e45c89dca0307fcc4734cac47aecab3d22da5d3ea846a701a36555b8029fe86d06178e70b80cf06c1e5cf4e30a1df624a46c93370c416b47aa1a289be78f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5AA5AVEJUYU9BP9453YY.temp
Filesize7KB
MD5082b9488ebc04cf8e4b0a88dc590086b
SHA18300c120430553fa552c437f024e3c03a89f1159
SHA256702932cffdd4b76c97182d2e47757e120cc4702e408f022a67086b3674028384
SHA512fb0e2c815591fe0982cdad679a4eb294b478e8d584756239df98667ee44ab12635ba3a7a52dafa1589f09920fcc2ced05861a7e969ec852b15e5b305a5281d42