Analysis
- max time kernel
1s - max time network
13s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 18:13
Errors
General
- Target target.ps1
- Size 2KB
- Sample261024-wts3dsbv8x
- SHA256 fd046ff2bf93108eb828d4e1469511913553910843d013a938c1444e30cf069a
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= recoveryenabled No -inputFormat xml -outputFormat text2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l1ugv2sj\l1ugv2sj.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4888.tmp" "c:\Users\Admin\AppData\Local\Temp\l1ugv2sj\CSCC133AE3FD7344A5092ECB6C042B46A84.TMP"3⤵
-
-
-
C:\Windows\system32\shutdown.exe"C:\Windows\system32\shutdown.exe" /s /f /t 02⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a31055 /state1:0x41c64e6d1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES4888.tmp
l1ugv2sj.dll
CSCC133AE3FD7344A5092ECB6C042B46A84.TMP
l1ugv2sj.0.cs
l1ugv2sj.cmdline
memory/1788-22-0x0000018746390000-0x0000018746398000-memory.dmp
memory/1788-8-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-9-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-0-0x00007FFD5178F000-0x00007FFD51790000-memory.dmp
memory/1788-6-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-5-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-7-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-3-0x0000018746300000-0x0000018746322000-memory.dmp
memory/1788-4-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-23-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-24-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-25-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp
memory/1788-26-0x00007FFD51600000-0x00007FFD51FA4000-memory.dmp