2f6e0b7d8633650d9ab391a47aed026f7f2eed2bf0a771b68b414dcbde94ff5f | Triage™

Analysis

max time kernel
791s
max time network
803s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
09/04/2024, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LeLockScreen.apk
Size 33KB
Sample240409-kk8wpseb6z
SHA256 546d843a9c57196a6ecf44aae6ad022da33f5d29448a034445ecd8b763809c21
MD5 d61df5ed148d063eebd7c24f4036f4d2
SHA1 c12dc929247b4fbb148f375c0acff2a39c3c36a3
SHA512 3c7c2c0eb4c200e512139f9ceb2752a452fefb110c32c2ebe4f3a8f9469334e6bf3b3b179c48e1f3417bb956f1f45950fb6629013a9d9a06203068312bf470f6
SSDEEP 768:uPokCGZ+jesdK/3hnKhpZTg+jesdK/3hnKhpZT9+jesdK/3hnKhpZTJNz3d:uP1CBjeQK+ZTHjeQK+ZTQjeQK+ZTJ5t
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion privilege_escalation

Malware Config

Signatures

Locks the device screen 1 TTPs 1 IoCs

Application may abuse the framework's APIs to lock the legitimate user out of the device.

Device Lockout

description	ioc	Process
Framework service call	android.app.admin.IDevicePolicyManager.lockNow	com.lenovo.onekeylock

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.lenovo.onekeylock

com.lenovo.onekeylock
1⤵
- Locks the device screen
- Tries to add a device administrator.
PID:4280

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Device Administrator Permissions

Defense Evasion

Impair Defenses

Device Lockout

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads