Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 11:14
Behavioral task
behavioral1
Sample
LockBit3Builder.7z
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
LockBit3Builder.7z
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
LockBit3Builder.7z
-
Size
144KB
-
MD5
7db3797ee09aedc1c6ec1389ab199493
-
SHA1
42bc848028f3256cd671301991795ecc44fef4e7
-
SHA256
453eebd2dcf98e15e9ccab2c706438a9d34497631db1f64b6fe9cc3ed41696da
-
SHA512
9b42015bbb7bed0bab806c73edf43ef523e96908a501373964aebf1aa6b61952f1e4c122ca0f9b25be60fc331abc082701cf0dedeb2ee95ec8b519bef9936e7a
-
SSDEEP
3072:6PLaNeqK0aYGnzelprFxDbuUqwRx5eWIgBefs5kZPPDFJEPZ8UYgp:6PqTK0aYG6lpXnu7ycNZ3RGh87+
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1712 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1712 AUDIODG.EXE Token: 33 1712 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1712 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1048 wrote to memory of 1136 1048 cmd.exe rundll32.exe PID 1048 wrote to memory of 1136 1048 cmd.exe rundll32.exe PID 1048 wrote to memory of 1136 1048 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\LockBit3Builder.7z1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\LockBit3Builder.7z2⤵
- Modifies registry class
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5801⤵
- Suspicious use of AdjustPrivilegeToken