LockDownBrowser[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LockDownBrowser.exe
Size

11.9MB
MD5

d81c79ffa1e14b2a9d2a81eee1c1bea9
SHA1

e6fa2e90590d5c2f2a4a787df8e869b0ad71a0e7
SHA256

d3eff18f5939dbd247204d81926e1f281a471c171a0fab8281d154d07ea36395
SHA512

14a769138bb2078a2dba0a754f663649cb558ed87ae68072d4a6a5f10b6dc6487d6cfba7ddc1323fd7a882b82ce308d29066fea8ca4b95ea79d29efa2d2f0b48
SSDEEP

98304:hRRdrCxCyVcTIQcM4qCj3GmZWq4q18TDoDlvhDVfa2WHiAza5kRORGvRU1:hRrCK9t4H2mjDDXxaHZnpv61

Score

1^/10

Malware Config

Signatures

Files

LockDownBrowser.exe
.exe windows x86

160f60c8372b8864c7eaaf30ab315c37

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:47:93:4b:89:c7:bf:20:92:a4:6f:52:93:f0:b2:da
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/08/2023, 00:00

Not After

08/09/2023, 23:59

Subject

CN=Respondus\, Inc.,O=Respondus\, Inc.,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:64:9b:91:52:25:bc:cb:80:e5:b3:e2:c6:d5:a6:21:01:92:62:42:15:7f:fe:88:c3:8a:19:18:56:7f:79:34
Signer

Actual PE Digest

2c:64:9b:91:52:25:bc:cb:80:e5:b3:e2:c6:d5:a6:21:01:92:62:42:15:7f:fe:88:c3:8a:19:18:56:7f:79:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
LocalAlloc
LocalFree
QueryFullProcessImageNameA
K32EnumProcesses
K32EnumProcessModules
K32GetModuleFileNameExA
GlobalAlloc
GlobalUnlock
GlobalLock
DecodePointer
GetFileAttributesA
WaitForSingleObject
GetSystemTimeAsFileTime
MultiByteToWideChar
GlobalAddAtomW
FlushFileBuffers
WriteConsoleW
GetFileSizeEx
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetEndOfFile
SetStdHandle
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
OpenProcess
ExitProcess
ReadConsoleW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
GetFileType
CreateFileW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFullPathNameW
GetDriveTypeW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetStartupInfoW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryA
TerminateProcess
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileSize
GetFileAttributesW
FindClose
CompareFileTime
ExpandEnvironmentStringsA
GetEnvironmentVariableA
GetTimeZoneInformation
WriteFile
ReadFile
CreateFileA
GetCurrentProcessId
LoadLibraryA
CreateProcessA
CreateMutexW
CloseHandle
FindNextFileA
FindFirstFileA
DeleteFileA
CreateDirectoryA
GetCommandLineW
GetSystemPowerStatus
SystemTimeToFileTime
MapViewOfFile
CreateFileMappingW
GetSystemTime
GetModuleFileNameA
GetNativeSystemInfo
GetSystemInfo
GlobalMemoryStatusEx
ProcessIdToSessionId
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
FindResourceW
GetCommandLineA
LockResource
LoadResource
GetTickCount
GetLocalTime
GetTempPathA
WideCharToMultiByte
Sleep
GetStdHandle
GetCurrentThread
GetThreadContext
HeapLock
HeapWalk
HeapUnlock
VirtualQuery
VirtualProtect

user32

LoadImageW
LoadIconW
EnumWindows
GetForegroundWindow
LoadAcceleratorsW
MsgWaitForMultipleObjectsEx
GetAsyncKeyState
EmptyClipboard
CloseClipboard
OpenClipboard
GetMonitorInfoA
EnumDisplayMonitors
SetWinEventHook
EnableWindow
GetWindowTextW
SetWindowTextW
SendDlgItemMessageW
PostMessageW
IsWindow
ShowWindow
GetClientRect
GetWindowThreadProcessId
EnumDisplayDevicesA
SystemParametersInfoW
GetWindowInfo
GetAncestor
EnumDesktopsA
CreateDialogParamW
SetWindowDisplayAffinity
PeekMessageW
GetKeyboardLayout
wsprintfW
LoadBitmapW
SetWindowPos
IsWindowVisible
GetWindowLongW
SetParent
UnregisterClassW
DialogBoxParamW
GetThreadDesktop
SetWindowLongW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
SetTimer
KillTimer
RegisterWindowMessageW
PostQuitMessage
IsChild
FillRect
MessageBoxW
GetClassNameA
OpenWindowStationA
GetUserObjectInformationW
MapVirtualKeyW
TranslateAcceleratorW
IsDialogMessageW
SendMessageW
CallWindowProcW
RegisterRawInputDevices
SetClipboardData
TrackMouseEvent
DrawTextA
ClientToScreen
SetRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetFocus
IsWindowEnabled
GetMenu
SetMenu
UpdateWindow
BeginPaint
ScreenToClient
EndPaint
SetPropW
PtInRect
NotifyWinEvent
SetDlgItemTextW
CheckRadioButton
GetDlgCtrlID
GetPropW
RemovePropW
GetDesktopWindow
FindWindowW
FindWindowExW
GetShellWindow
GetActiveWindow
MessageBoxA
GetWindowTextA
RedrawWindow
InvalidateRect
SetForegroundWindow
DrawTextW
GetSystemMetrics
GetFocus
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextA
MoveWindow
GetClassInfoExW
SendMessageA
GetMonitorInfoW
MonitorFromWindow
GetWindow
MapWindowPoints
GetWindowRect
SetWindowTextA
SetDlgItemTextA
GetDlgItem
EndDialog
ReleaseDC
GetDC
LoadStringW
LoadCursorW
EnumChildWindows
GetParent
AdjustWindowRectEx

gdi32

SetBkColor
GetStockObject
TextOutW
MoveToEx
GetObjectW
SetTextColor
SetBkMode
SelectObject
LineTo
GetTextExtentPoint32W
DeleteDC
CombineRgn
CreateFontW
CreateSolidBrush
DeleteObject
PtInRegion
SetRectRgn
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgn
CreatePen

comdlg32

FindTextW

advapi32

AllocateAndInitializeSid
GetTokenInformation
FreeSid
CheckTokenMembership
AdjustTokenPrivileges
OpenProcessToken
ReadEventLogW
RegCreateKeyExA
ConvertSidToStringSidA
StartServiceW
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyExA
RegCreateKeyA
RegCloseKey
CloseEventLog
OpenEventLogW
LookupPrivilegeValueW

shell32

ShellExecuteA
SHGetFolderPathW
SHGetFolderPathA

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
CoInitializeSecurity

oleaut32

VariantChangeType
VariantClear
VariantInit
SysFreeString
SysAllocString

comctl32

ImageList_Create
ImageList_Add
ord410
ord413
_TrackMouseEvent

libcef

cef_get_min_log_level
cef_string_utf16_cmp
cef_string_ascii_to_utf16
cef_get_current_platform_thread_id
cef_string_utf16_to_utf8
cef_string_utf8_to_utf16
cef_string_utf16_clear
cef_string_utf8_clear
cef_string_utf16_set
cef_log
cef_string_userfree_utf16_free
cef_string_multimap_alloc
cef_string_multimap_free
cef_request_create
cef_urlrequest_create
cef_value_create
cef_cookie_manager_get_global_manager
cef_string_list_alloc
cef_string_list_free
cef_request_context_get_global_context
cef_request_context_create_context
cef_create_context_shared
cef_currently_on
cef_post_task
cef_execute_process
cef_initialize
cef_shutdown
cef_do_message_loop_work
cef_run_message_loop
cef_quit_message_loop
cef_crash_reporting_enabled
cef_set_crash_key_value
cef_load_crlsets_file
cef_get_mime_type
cef_base64encode
cef_uriencode
cef_api_hash
cef_browser_host_create_browser
cef_string_map_alloc
cef_string_map_free
cef_command_line_create
cef_command_line_get_global
cef_process_message_create
cef_set_osmodal_loop
cef_post_data_create
cef_post_data_element_create
cef_dictionary_value_create
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_v8context_get_current_context
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_string
cef_v8value_create_function
cef_shared_process_message_builder_create

wininet

HttpQueryInfoA
InternetCloseHandle
InternetOpenW
InternetQueryOptionA
InternetConnectA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

oleacc

LresultFromObject
AccessibleObjectFromWindow

msimg32

GradientFill

ws2_32

gethostname

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

winmm

waveInPrepareHeader
waveInUnprepareHeader
waveInClose
waveInStart
waveInAddBuffer
waveInOpen

lockdownbrowser

?CLDBDoSomeOtherStuffs@@YAHPAH@Z
?CLDBDoYetMoreStuff@@YAHPAH@Z
?CLDBDoSomeOtherStuff@@YAHPAH@Z
?CLDBDoSomeStuff@@YAHPAH@Z

wintrust

WinVerifyTrust

rpcrt4

UuidCreate

shlwapi

PathFileExistsA
PathAppendA

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

160f60c8372b8864c7eaaf30ab315c37

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:47:93:4b:89:c7:bf:20:92:a4:6f:52:93:f0:b2:daCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

2c:64:9b:91:52:25:bc:cb:80:e5:b3:e2:c6:d5:a6:21:01:92:62:42:15:7f:fe:88:c3:8a:19:18:56:7f:79:34Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

libcef

wininet

iphlpapi

setupapi

version

oleacc

msimg32

ws2_32

wtsapi32

winmm

lockdownbrowser

wintrust

rpcrt4

shlwapi

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 325KB - Virtual size: 325KB

.data Size: 17KB - Virtual size: 22KB

.rsrc Size: 6.1MB - Virtual size: 6.1MB

.reloc Size: 69KB - Virtual size: 69KB

.idata Size: 13KB - Virtual size: 13KB

.text Size: 4.3MB - Virtual size: 4.3MB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:47:93:4b:89:c7:bf:20:92:a4:6f:52:93:f0:b2:da
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

2c:64:9b:91:52:25:bc:cb:80:e5:b3:e2:c6:d5:a6:21:01:92:62:42:15:7f:fe:88:c3:8a:19:18:56:7f:79:34
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 325KB - Virtual size: 325KB

.data
Size: 17KB - Virtual size: 22KB

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

.reloc
Size: 69KB - Virtual size: 69KB

.idata
Size: 13KB - Virtual size: 13KB

.text
Size: 4.3MB - Virtual size: 4.3MB