Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 22:23
General
- Target run.ps1
- Size 13KB
- Sample260822-2a9tpagf39
- SHA256 e04d51956b68a863efc95c041ea45b5d4ef19fc0ad163ae7029187dd6596216d
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Disables Task Manager via registry modification
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Modifies WinLogon for persistence
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cbs43vuq\cbs43vuq.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C2D.tmp" "c:\Users\Admin\AppData\Local\Temp\cbs43vuq\CSCA67124FC348240E18371523EC97B5441.TMP"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\\darkside_lock.html"2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "while($true){Start-Sleep -Seconds 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
ModuleAnalysisCache
RES6C2D.tmp
__PSScriptPolicyTest_jguho01w.t3w.ps1
cbs43vuq.dll
darkside_lock.html
CSCA67124FC348240E18371523EC97B5441.TMP
cbs43vuq.0.cs
cbs43vuq.cmdline
memory/4084-42-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4084-38-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4084-72-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4084-70-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4084-44-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4084-41-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4084-40-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4084-39-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-30-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-0-0x00007FFCEB92F000-0x00007FFCEB930000-memory.dmp
memory/4520-33-0x000001CE20AC0000-0x000001CE20ADE000-memory.dmp
memory/4520-6-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-35-0x000001CE20AE0000-0x000001CE20AEA000-memory.dmp
memory/4520-36-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-37-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-34-0x000001CE21060000-0x000001CE21112000-memory.dmp
memory/4520-26-0x000001CE21270000-0x000001CE2147A000-memory.dmp
memory/4520-21-0x000001CE20A60000-0x000001CE20A68000-memory.dmp
memory/4520-25-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-24-0x000001CE20EE0000-0x000001CE21056000-memory.dmp
memory/4520-23-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-29-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-43-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-10-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-59-0x000001CE21A50000-0x000001CE21C12000-memory.dmp
memory/4520-60-0x000001CE22150000-0x000001CE22678000-memory.dmp
memory/4520-5-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-68-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-69-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-22-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-71-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-13-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp
memory/4520-4-0x000001CE209F0000-0x000001CE20A12000-memory.dmp
memory/4520-3-0x00007FFCEB7A0000-0x00007FFCEC144000-memory.dmp