rule MAL_RANSOM_Lorenz_May21_1
{
	meta:
		description = "Detects Lorenz Ransomware samples"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Research - DACH TE"
		date = "2021-05-04"
		hash1 = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
		hash2 = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b1828540793340d1"
		hash3 = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
		id = "0b18a4a3-82da-574b-8d10-daf2176448b9"

	strings:
		$x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
		$x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
		$s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
		$s2 = "twr.ini" ascii fullword
		$s3 = "/c wmic /node:'" ascii fullword
		$op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
		$op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( 1 of ( $x* ) or all of ( $op* ) or 3 of them )
}