Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 11:44
Static task
static1
Behavioral task
behavioral1
Sample
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps1
Resource
win10v2004-20241007-en
General
-
Target
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps1
-
Size
590KB
-
MD5
2b84852065e28974e4081826ff09ddc1
-
SHA1
fa70a7f2a36ba300f57b130a31ef1ab66a1397ac
-
SHA256
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30
-
SHA512
63f44bc545a7b7da355903f99dcbfd0033756f41717bc9b210bdc2094f97c2efa68dee814d03e392d94e579ae170e16ef447f86b07363b1fedffa7c7d3b54ce1
-
SSDEEP
1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJw:cR
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule behavioral2/memory/3728-62-0x0000000010000000-0x0000000010022000-memory.dmp family_lockbit -
pid Process 3116 powershell.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2744 3728 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3116 powershell.exe 3116 powershell.exe 3728 powershell.exe 3728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3116 powershell.exe Token: SeDebugPrivilege 3728 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3116 wrote to memory of 3728 3116 powershell.exe 83 PID 3116 wrote to memory of 3728 3116 powershell.exe 83 PID 3116 wrote to memory of 3728 3116 powershell.exe 83
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 29483⤵
- Program crash
PID:2744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3728 -ip 37281⤵PID:1960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ca6e5843fe0f30068ddef94b0b542eca
SHA11527177e5ccfe0041918840613af104d2ba8a1c8
SHA2562655330566a9953364d9e13e939b3938e96a7b752d4f65f9586841b777ef137a
SHA5123296343e54290ae3c86d7f2deac6fe3e98a0b63428132aea9ae9b1d17805c7cadea183245e7ae9ee2d785430565989f0cd27a49600e7d8c61db66d151450b0e9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82