Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 04:15
Static task
static1
Behavioral task
behavioral1
Sample
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps1
Resource
win10v2004-20241007-en
General
-
Target
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps1
-
Size
590KB
-
MD5
2b84852065e28974e4081826ff09ddc1
-
SHA1
fa70a7f2a36ba300f57b130a31ef1ab66a1397ac
-
SHA256
6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30
-
SHA512
63f44bc545a7b7da355903f99dcbfd0033756f41717bc9b210bdc2094f97c2efa68dee814d03e392d94e579ae170e16ef447f86b07363b1fedffa7c7d3b54ce1
-
SSDEEP
1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJw:cR
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule behavioral2/memory/4600-63-0x0000000010000000-0x0000000010022000-memory.dmp family_lockbit -
pid Process 1220 powershell.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3552 4600 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1220 powershell.exe 1220 powershell.exe 4600 powershell.exe 4600 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1220 powershell.exe Token: SeDebugPrivilege 4600 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1220 wrote to memory of 4600 1220 powershell.exe 83 PID 1220 wrote to memory of 4600 1220 powershell.exe 83 PID 1220 wrote to memory of 4600 1220 powershell.exe 83
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\Admin\AppData\Local\Temp\6adb8f7da4d7ff92c40f0f8231c7469865b170b440be5f2789724a2abe005b30.ps12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 27363⤵
- Program crash
PID:3552
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4600 -ip 46001⤵PID:180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b862de0a6a6a09fdffbfe4781381fb41
SHA1df517a41b5e192c55c0f7e813a4ff23d91e80dd7
SHA256a12d7b9c11c73fe2cbceae615527de69ea86034df0d9caeeb2e5009d9b1d5f7c
SHA512a5dfb9417136708e513ee1ce863bd3a62e7b5255c8416d5f7b5bae0f0675872c8b3475442557e10035a3486cca4d6e1a1a4a8bd81ce94c111aaf284be4e86d0d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82