Analysis
-
max time kernel
1754s -
max time network
1693s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 11:34
Behavioral task
behavioral1
Sample
LockBit-V3.zip
Resource
win7-20240221-en
windows7-x64
22 signatures
1800 seconds
Behavioral task
behavioral2
Sample
LockBit-V3.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
1800 seconds
General
-
Target
LockBit-V3.zip
-
Size
293KB
-
MD5
f35c9e87f63d3f8d4db5b1a01a14e464
-
SHA1
7fd87ed64dbb2780b5deccc0a9d138b3b9402e8b
-
SHA256
4dfa2dcbcfe39550255fcf5daaa4ee3b74e7ea3a32666c91c100fb6b8508544b
-
SHA512
04d8f57d6a592d30b3af8ee96ed2480a2b594b25a37b500613a06aee994705045140ed6f4152c97f17e935122003d45d6ae64fad668a08cf7e6438f48e3167e3
-
SSDEEP
6144:50gWKhB5TA1yAmI28MqQoZNTelXsxRw5Bp0i49h/t1uDcMxDM074:50gWw5rA08MLCeG/i49JEcUE
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 1160 svchost.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\LockBit-V3.zip1⤵PID:4968
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4016
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160