Analysis
-
max time kernel
64s -
max time network
66s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
10-01-2025 12:51
Behavioral task
behavioral1
Sample
80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
10 signatures
300 seconds
General
-
Target
80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe
-
Size
162KB
-
MD5
38745539b71cf201bb502437f891d799
-
SHA1
f2a72bee623659d3ba16b365024020868246d901
-
SHA256
80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
-
SHA512
772e76757069c3375cf1ffd659ff03f47f2d4becae61a852adbc27ae467551210d8832994f944c05fccc8486a8a88322021c94217a8bd962c2459af41067132b
-
SSDEEP
3072:MC/pu0EzJTnvxkIKztqGJ0OtiZ4/7I5jfa2F63Jvb3iN0RD3xpjb68Tzd4Tpx8W7:MC/pu1iIKztqGuU/7Ity2F65vb3FRlpW
Score
10/10
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
resource yara_rule behavioral1/memory/3328-0-0x0000000000400000-0x000000000042C000-memory.dmp family_lockbit behavioral1/memory/3328-1-0x0000000000400000-0x000000000042C000-memory.dmp family_lockbit -
Program crash 1 IoCs
pid pid_target Process procid_target 2904 3328 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4776 taskmgr.exe Token: SeSystemProfilePrivilege 4776 taskmgr.exe Token: SeCreateGlobalPrivilege 4776 taskmgr.exe Token: 33 4776 taskmgr.exe Token: SeIncBasePriorityPrivilege 4776 taskmgr.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe 4776 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe"C:\Users\Admin\AppData\Local\Temp\80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 2722⤵
- Program crash
PID:2904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3328 -ip 33281⤵PID:1820
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4776