Analysis
-
max time kernel
38s -
max time network
34s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
10-01-2025 12:53
Behavioral task
behavioral1
Sample
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
10 signatures
300 seconds
General
-
Target
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe
-
Size
162KB
-
MD5
bd440d2c348b4cc4b6ad75f92d9e1c13
-
SHA1
faafd96ac68278360353c35d0bf3d5a353292f11
-
SHA256
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
-
SHA512
8da82f0496b1a7bcb6cf0523858efd7110f1da5320399bc9be7d23cdd9a53716685af5619559265edb858d50e7c9abb1ebb63fa67aca6f06c9869528046d5ea1
-
SSDEEP
3072:Iy1IbCkfer2IsGpQf8oFTO3PfvXdG4pcT+fwfNZi5kSpRIFf34icFQ+d5S:IcxkOTpQ8olO/fvc5T+iNEkJ34igQ+/S
Score
10/10
Malware Config
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x000000000042C000-memory.dmp family_lockbit behavioral1/memory/1720-1-0x0000000000400000-0x000000000042C000-memory.dmp family_lockbit -
Program crash 1 IoCs
pid pid_target Process procid_target 2352 1720 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1708 taskmgr.exe Token: SeSystemProfilePrivilege 1708 taskmgr.exe Token: SeCreateGlobalPrivilege 1708 taskmgr.exe Token: 33 1708 taskmgr.exe Token: SeIncBasePriorityPrivilege 1708 taskmgr.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe"C:\Users\Admin\AppData\Local\Temp\391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2722⤵
- Program crash
PID:2352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1720 -ip 17201⤵PID:780
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1708