Overview

overview

10

Static

static

10

_eab74cb48...d2.ps1

windows10-2004-x64

10

_eab74cb48...d2.ps1

windows11-21h2-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    137s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/08/2025, 04:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _eab74cb48e2926577d16ea10695b75185ca6c4b36f365c117e1cabe4900c6cd2.ps1
  • Size 7KB
  • Sample250802-eptdxsxpy4
  • SHA256 eab74cb48e2926577d16ea10695b75185ca6c4b36f365c117e1cabe4900c6cd2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwaredefense_evasionexecutionimpactpersistenceransomwarespyware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\IMPORTANT.txt

Ransom Note
  • ALL YOUR IMPORTANT FILES ARE ENCRYPTED BY THE RANSOMWARE POWERLOCKER 5.4 WITH A POWERFULL AES-256 ENCRYPTION METHOD Rules: 1. DO NOT CHANGE THE FILE EXTENSION AND NAME OF YOUR FILES OR YOUR FILES WILL BE LOST FOREVER 2. DO NOT USE ANY THIRD-PARTY SOFTWARE FOR DECRYPT YOUR DATA OR YOUR DATA CAN BE LOST FOREVER But I promise you that all your files will be decrypted if you make the next steps. 1. Write a email to [email protected] 2. In the email say that you were infected with the PowerLocker5.4 ransomware. 3. We will negociate the ransomware decryption software. And that's all :)

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Blocklisted process makes network request 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 49 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_eab74cb48e2926577d16ea10695b75185ca6c4b36f365c117e1cabe4900c6cd2.ps1
    1⤵
    • Blocklisted process makes network request
    • Sets desktop wallpaper using registry
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\system32\vssadmin.exe
      "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:2220
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1m2tx1bj\1m2tx1bj.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5592
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES856C.tmp" "c:\Users\Admin\AppData\Local\Temp\1m2tx1bj\CSC10E351199A05449AA0FF3A5E6EC6CC9.TMP"
        3⤵
          PID:4880
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b1r0e4db\b1r0e4db.cmdline"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8AAC.tmp" "c:\Users\Admin\AppData\Local\Temp\b1r0e4db\CSCE8DBBA726AA1454A91D4BA6386E7AAA9.TMP"
          3⤵
            PID:4928
        • C:\Windows\system32\notepad.exe
          "C:\Windows\system32\notepad.exe" C:\Users\Admin\Desktop\IMPORTANT.txt
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:6140
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3364
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3448
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5588
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1692

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Chrome Extensions.txt
            • Path C:\Users\Admin\AppData\Chrome Extensions.txt
            • Size 5KB
            • SHA256 3bb1e67107d3eb78b10740fac4e24078272f53e85a2a757159d78a194ca3cb8f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            www.bing[1].xml
            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZU7LX45G\www.bing[1].xml
            • Size 328B
            • SHA256 6917f4bede774e4cbfaf474cdb6be9e4b2bc0ffa30ce6f8b5b15ca9fd9855025
            • MD5 SHA1 SHA512
            Submit Download

            www.bing[1].xml
            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZU7LX45G\www.bing[1].xml
            • Size 17KB
            • SHA256 0ea7a86f026234f6bba35e2a1564eb5923b5052fa8afd5fb012d90031fe20b86
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            www.bing[1].xml
            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZU7LX45G\www.bing[1].xml
            • Size 14KB
            • SHA256 7358880059866f4c1eb9261f9ca73aa2e3122f40236ce806a356688a255d7d9e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            1m2tx1bj.dll
            • Path C:\Users\Admin\AppData\Local\Temp\1m2tx1bj\1m2tx1bj.dll
            • Size 3KB
            • SHA256 ce124acd509d3bef296980f6095e9274af9a31aa32b8fcd297e6aac223b13261
            • MD5 SHA1 SHA512
            Submit Download

            RES856C.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RES856C.tmp
            • Size 1KB
            • SHA256 89f6df85fb1e93eb6d0e90fb5cf1eff180b1710f26a187c3e6fb9dfd876668fd
            • MD5 SHA1 SHA512
            Submit Download

            RES8AAC.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RES8AAC.tmp
            • Size 1KB
            • SHA256 f420d5072238b5dfa0ee9f9b3f2636a3e66625bde0dd7cc45cf6dc9d2c167da9
            • MD5 SHA1 SHA512
            Submit Download

            __PSScriptPolicyTest_htzk1dsj.ovw.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_htzk1dsj.ovw.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512
            Submit Download

            b1r0e4db.dll
            • Path C:\Users\Admin\AppData\Local\Temp\b1r0e4db\b1r0e4db.dll
            • Size 3KB
            • SHA256 b61c3f8ca42783136d7b34fd13bbc01d8584ca8b27ef430bb7b440f36a1d87b8
            • MD5 SHA1 SHA512
            Submit Download

            IMPORTANT.txt
            • Path C:\Users\Admin\Desktop\IMPORTANT.txt
            • Size 616B
            • SHA256 931d80ccd163fcc5956946ed9b85da10580571684d4f54d9f2a6f5b72f914287
            • MD5 SHA1 SHA512
            Submit Download

            1m2tx1bj.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\1m2tx1bj\1m2tx1bj.0.cs
            • Size 681B
            • SHA256 e2715d4fc9403e89a2931a24e90278efdff72adc86ad80739ff089a22ceea467
            • MD5 SHA1 SHA512
            Submit Download

            1m2tx1bj.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\1m2tx1bj\1m2tx1bj.cmdline
            • Size 369B
            • SHA256 f6799340f70fa784c4473415f9138537a89a2e50988942db576edd5477faf10c
            • MD5 SHA1 SHA512
            Submit Download

            CSC10E351199A05449AA0FF3A5E6EC6CC9.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\1m2tx1bj\CSC10E351199A05449AA0FF3A5E6EC6CC9.TMP
            • Size 652B
            • SHA256 b0a4df86365097f9c8c19ac2c1b4327c86c553b5030024f4256a3bb1b98d8689
            • MD5 SHA1 SHA512
            Submit Download

            CSCE8DBBA726AA1454A91D4BA6386E7AAA9.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\b1r0e4db\CSCE8DBBA726AA1454A91D4BA6386E7AAA9.TMP
            • Size 652B
            • SHA256 aca512352ccadf36be2856430af72520121aa8cc851feea275fe8a0f833e6e7c
            • MD5 SHA1 SHA512
            Submit Download

            b1r0e4db.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\b1r0e4db\b1r0e4db.0.cs
            • Size 222B
            • SHA256 bcb5293a92004175d74a360f33d61e7865bade17bc01057406f2dff79a34d7fd
            • MD5 SHA1 SHA512
            Submit Download

            b1r0e4db.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\b1r0e4db\b1r0e4db.cmdline
            • Size 369B
            • SHA256 6c5f4ec524c911b14a573ea6efadce94bbfadc0991c434d009114fd010b51fee
            • MD5 SHA1 SHA512
            Submit Download

            memory/2100-11-0x0000022820610000-0x0000022820620000-memory.dmp
            Download

            memory/2100-27-0x0000022839380000-0x0000022839388000-memory.dmp
            Download

            memory/2100-41-0x00000228393A0000-0x00000228393A8000-memory.dmp
            Download

            memory/2100-14-0x0000022820610000-0x0000022820620000-memory.dmp
            Download

            memory/2100-13-0x0000022839000000-0x0000022839024000-memory.dmp
            Download

            memory/2100-12-0x0000022839000000-0x000002283902A000-memory.dmp
            Download

            memory/2100-0-0x0000022820610000-0x0000022820620000-memory.dmp
            Download

            memory/2100-1-0x0000022820610000-0x0000022820620000-memory.dmp
            Download

            memory/2100-7-0x00000228208D0000-0x00000228208F2000-memory.dmp
            Download

            memory/5588-167-0x0000021B56100000-0x0000021B56200000-memory.dmp
            Download

            memory/5588-220-0x0000021B79A10000-0x0000021B79A30000-memory.dmp
            Download

            memory/5588-219-0x0000021B7A320000-0x0000021B7A340000-memory.dmp
            Download

            memory/5588-327-0x0000021B7DE00000-0x0000021B7DF00000-memory.dmp
            Download

            memory/5588-374-0x0000021B7E700000-0x0000021B7E800000-memory.dmp
            Download

            memory/5588-218-0x0000021B7A200000-0x0000021B7A300000-memory.dmp
            Download