Analysis
-
max time kernel
92s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 11:44
Static task
static1
Behavioral task
behavioral1
Sample
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
Resource
win10v2004-20241007-en
General
-
Target
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
-
Size
590KB
-
MD5
e0411fcbbff0e20922d224c3ac8c811e
-
SHA1
1083bc3407717b9953ffe27ec8ef3f0a520fbc82
-
SHA256
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527
-
SHA512
0555dbe49cc4ac2e432b85e847ac48113d74651f8c238329645b1bb07968d3418e92122b7750a3902793824a932647fe5c27c1c3e841a010a354d789c358eba3
-
SSDEEP
1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJt:cA
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule behavioral2/memory/4432-64-0x0000000010000000-0x0000000010022000-memory.dmp family_lockbit -
pid Process 1104 powershell.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 408 4432 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1104 powershell.exe 1104 powershell.exe 4432 powershell.exe 4432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1104 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1104 wrote to memory of 4432 1104 powershell.exe 83 PID 1104 wrote to memory of 4432 1104 powershell.exe 83 PID 1104 wrote to memory of 4432 1104 powershell.exe 83
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 29443⤵
- Program crash
PID:408
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4432 -ip 44321⤵PID:5108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59e45e784e2d640c1aa8a549678d2a7d3
SHA1621289ba2924275a478803b174eb2c83e5776dea
SHA256d3025c9eba17f1dc87204c5a61e53ad8d6850aeff328ad7586745101e2dc591d
SHA512cba024347d760ec5f14dde94bac54cc744af081b4e0aa0e9854f2943a6532e6dec950081326cbbaea41c4606fba671b54b098e43f02a49a381648fc004b65bd9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82