Analysis

  • max time kernel
    1754s
  • max time network
    1693s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2024 11:34

General

  • Target

    LockBit-V3.zip

  • Size

    293KB

  • MD5

    f35c9e87f63d3f8d4db5b1a01a14e464

  • SHA1

    7fd87ed64dbb2780b5deccc0a9d138b3b9402e8b

  • SHA256

    4dfa2dcbcfe39550255fcf5daaa4ee3b74e7ea3a32666c91c100fb6b8508544b

  • SHA512

    04d8f57d6a592d30b3af8ee96ed2480a2b594b25a37b500613a06aee994705045140ed6f4152c97f17e935122003d45d6ae64fad668a08cf7e6438f48e3167e3

  • SSDEEP

    6144:50gWKhB5TA1yAmI28MqQoZNTelXsxRw5Bp0i49h/t1uDcMxDM074:50gWw5rA08MLCeG/i49JEcUE

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\LockBit-V3.zip
    1⤵
      PID:4968
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:4016
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1160

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1160-16-0x000001DEC8940000-0x000001DEC8950000-memory.dmp

        Filesize

        64KB

      • memory/1160-0-0x000001DEC8840000-0x000001DEC8850000-memory.dmp

        Filesize

        64KB

      • memory/1160-32-0x000001DED0C40000-0x000001DED0C41000-memory.dmp

        Filesize

        4KB

      • memory/1160-34-0x000001DED0C70000-0x000001DED0C71000-memory.dmp

        Filesize

        4KB

      • memory/1160-35-0x000001DED0C70000-0x000001DED0C71000-memory.dmp

        Filesize

        4KB

      • memory/1160-36-0x000001DED0D80000-0x000001DED0D81000-memory.dmp

        Filesize

        4KB