Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
Resource
win10v2004-20241007-en
General
-
Target
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps1
-
Size
590KB
-
MD5
e0411fcbbff0e20922d224c3ac8c811e
-
SHA1
1083bc3407717b9953ffe27ec8ef3f0a520fbc82
-
SHA256
69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527
-
SHA512
0555dbe49cc4ac2e432b85e847ac48113d74651f8c238329645b1bb07968d3418e92122b7750a3902793824a932647fe5c27c1c3e841a010a354d789c358eba3
-
SSDEEP
1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJt:cA
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule behavioral1/memory/2968-15-0x0000000010000000-0x0000000010022000-memory.dmp family_lockbit -
pid Process 1868 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1868 powershell.exe 1868 powershell.exe 1868 powershell.exe 2968 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 2968 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2968 1868 powershell.exe 29 PID 1868 wrote to memory of 2968 1868 powershell.exe 29 PID 1868 wrote to memory of 2968 1868 powershell.exe 29 PID 1868 wrote to memory of 2968 1868 powershell.exe 29 PID 2968 wrote to memory of 2496 2968 powershell.exe 31 PID 2968 wrote to memory of 2496 2968 powershell.exe 31 PID 2968 wrote to memory of 2496 2968 powershell.exe 31 PID 2968 wrote to memory of 2496 2968 powershell.exe 31
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\69487c2f91495cfda293735fc01ac8d516b48359171e3b53581ccf3145bfb527.ps12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2968" "960"3⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cd8af8638269eb936df89b5971ad9742
SHA1dd3628e6724eb87028ca15bd99d454ba50dde45b
SHA2562240e8370e7c22d8d346a10d64c89ca23a84414988e661b591a57102647da929
SHA51263e60c0c1d0170168929a73e5584ea85a224863ff3197d51240385fe734de76066d6346e3c0b66cecfedcaa0d52826ea122c78e300e4218ee8a8423dc7f0bd9f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\COXV3OBIAI0IGR57XERG.temp
Filesize7KB
MD5c7412bb8af56b36b61a5171acead31df
SHA1ef42a7e54d12a5afa953b3d1db009863bcf332d5
SHA25656f322887acfd25a2fc60d2a4b469b936a08b0871fd711778d7c0e6586da85a9
SHA512939feb1f4aa8bba1d02d58031f1ebd686c000c3602cf151168dcbb88712ca61bb204092fb20d103498e67d8d1000584cea11e543a2aefb5b6d5189222c78cd1f