Analysis
- max time kernel
140s - max time network
122s - platform
windows7_x64 - resource
win7-20240319-en - resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system - submitted
09/04/2024, 12:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
lockfolder.exe
Resource
win7-20240319-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
lockfolder.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target lockfolder.exe
- Size 2.3MB
- Sample240409-ph6qsaaa7z
- SHA256 b0b68d448a4e9b7d1963b488a2172225b1df71ec4783054cd7db9a543c249aff
- MD5 c55394d33234a40c961ff167e9beabc0
- SHA1 67e841ee574521c4d72d66cfaa7fd50e94a3a608
- SHA512 f45d225fcdca45cf613faf3b259f96c63b9097069f8c9bb88a0f11a7433e969bc9bbd43753d19ae26d5a72a8d281bf69bfec704b4eda1ca686107456d04889db
- SSDEEP 24576:ihVIuDtBuDwdKsION5KTyBIHLEq1qTpYMaCWH9w7XKVUFFu0iKVukhCWzl:ihCuDtgaHN5zkEYMaFH9w7XKKIKVukIw
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0006000000015e25-36.dat acprotect behavioral1/files/0x00060000000161f8-42.dat acprotect behavioral1/files/0x00060000000162b3-47.dat acprotect - Loads dropped DLL 10 IoCs
pid Process 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2848 regsvr32.exe 2440 regsvr32.exe -
resource yara_rule behavioral1/files/0x0006000000015e25-36.dat upx behavioral1/memory/2880-38-0x0000000003FB0000-0x0000000003FF6000-memory.dmp upx behavioral1/files/0x00060000000161f8-42.dat upx behavioral1/memory/2848-44-0x00000000001F0000-0x0000000000219000-memory.dmp upx behavioral1/files/0x00060000000162b3-47.dat upx behavioral1/memory/2440-49-0x00000000001A0000-0x000000000021C000-memory.dmp upx behavioral1/memory/2880-51-0x0000000003FB0000-0x0000000003FF6000-memory.dmp upx - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: lockfolder.exe File opened (read-only) \??\M: lockfolder.exe File opened (read-only) \??\S: lockfolder.exe File opened (read-only) \??\T: lockfolder.exe File opened (read-only) \??\W: lockfolder.exe File opened (read-only) \??\E: lockfolder.exe File opened (read-only) \??\L: lockfolder.exe File opened (read-only) \??\N: lockfolder.exe File opened (read-only) \??\V: lockfolder.exe File opened (read-only) \??\Y: lockfolder.exe File opened (read-only) \??\A: lockfolder.exe File opened (read-only) \??\I: lockfolder.exe File opened (read-only) \??\P: lockfolder.exe File opened (read-only) \??\R: lockfolder.exe File opened (read-only) \??\U: lockfolder.exe File opened (read-only) \??\Q: lockfolder.exe File opened (read-only) \??\X: lockfolder.exe File opened (read-only) \??\B: lockfolder.exe File opened (read-only) \??\G: lockfolder.exe File opened (read-only) \??\H: lockfolder.exe File opened (read-only) \??\K: lockfolder.exe File opened (read-only) \??\O: lockfolder.exe - Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6C788253-1062-4DDE-BBAA-14C6C9C80B70} regsvr32.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 lockfolder.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\FileHook.dll lockfolder.exe File opened for modification C:\Windows\SysWOW64\FileHook.dll lockfolder.exe File created C:\Windows\SysWOW64\FileBho.dll lockfolder.exe File opened for modification C:\Windows\SysWOW64\FileBho.dll lockfolder.exe File created C:\Windows\SysWOW64\hfile.sys lockfolder.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\lockfd.dll lockfolder.exe File created C:\Windows\lockfd.dll lockfolder.exe File opened for modification C:\Windows\systemlockfile008 lockfolder.exe - Modifies registry class 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C788253-1062-4DDE-BBAA-14C6C9C80B70}\ProgID\ = "FileBho.FileBho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C788253-1062-4DDE-BBAA-14C6C9C80B70} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C788253-1062-4DDE-BBAA-14C6C9C80B70}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C788253-1062-4DDE-BBAA-14C6C9C80B70}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FileBho.FileBho\Clsid\ = "{6C788253-1062-4DDE-BBAA-14C6C9C80B70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD11ABAA-6F3F-4C5C-90A3-AEDFB93A01CE}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\folderCopyHook regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FileBho.FileBho regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FileBho.FileBho\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C788253-1062-4DDE-BBAA-14C6C9C80B70}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C788253-1062-4DDE-BBAA-14C6C9C80B70}\InprocServer32\ = "C:\\Windows\\SysWOW64\\FileBho.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C788253-1062-4DDE-BBAA-14C6C9C80B70}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD11ABAA-6F3F-4C5C-90A3-AEDFB93A01CE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD11ABAA-6F3F-4C5C-90A3-AEDFB93A01CE}\ = "folder CopyHook Shell Extension" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD11ABAA-6F3F-4C5C-90A3-AEDFB93A01CE}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\folderCopyHook\ = "{FD11ABAA-6F3F-4C5C-90A3-AEDFB93A01CE}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD11ABAA-6F3F-4C5C-90A3-AEDFB93A01CE}\InprocServer32\ = "C:\\Windows\\SysWOW64\\FileHook.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FileBho.FileBho\Clsid regsvr32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found - Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe 2880 lockfolder.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2848 2880 lockfolder.exe 28 PID 2880 wrote to memory of 2848 2880 lockfolder.exe 28 PID 2880 wrote to memory of 2848 2880 lockfolder.exe 28 PID 2880 wrote to memory of 2848 2880 lockfolder.exe 28 PID 2880 wrote to memory of 2848 2880 lockfolder.exe 28 PID 2880 wrote to memory of 2848 2880 lockfolder.exe 28 PID 2880 wrote to memory of 2848 2880 lockfolder.exe 28 PID 2880 wrote to memory of 2440 2880 lockfolder.exe 29 PID 2880 wrote to memory of 2440 2880 lockfolder.exe 29 PID 2880 wrote to memory of 2440 2880 lockfolder.exe 29 PID 2880 wrote to memory of 2440 2880 lockfolder.exe 29 PID 2880 wrote to memory of 2440 2880 lockfolder.exe 29 PID 2880 wrote to memory of 2440 2880 lockfolder.exe 29 PID 2880 wrote to memory of 2440 2880 lockfolder.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\lockfolder.exe"C:\Users\Admin\AppData\Local\Temp\lockfolder.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe FileHook.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2848
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe FileBho.dll /s2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\FileBho.dll
- Size 184KB
- SHA256 2483e09fc6f919d045f1c2f7907dc5f3334be64468f33fb5ebf34e939da45fba
- MD5 41d10ef5005a4d4948385ab49bf7c437
- SHA1 1f9cf3ea27491068f4c59f2f7ef7d74b1b14f52e
- SHA512 60524def39655e5e5c4cd0c6d4d50ff58e0affffeeab88c033311f64ff990552d87202efdc603508df5776a4df1c192aa2ba878ce4bc5d073f4e39f398d87723
- SSDEEP 3072:72MCkb8HfGWXtOZ76hJo3dwDT7+HtTI5FGnuN1PIUNKk8PsJuIQG5h:gLn9O56MwjqtTaFGnuN1Pbn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\FileHook.dll
- Size 56KB
- SHA256 9387b97a14410617dc2d5a8f1264d8047e55a1e88dc58ba99de65876469d7688
- MD5 ee83d2b1298276b61c569e79b404a72e
- SHA1 66924d8f0eb343218f955f5ddd3812f8c9489f08
- SHA512 e2b49e740202f63e81b7892a3a2ca62e641ca9b51e608bad906644914112daa96a17326807c281e28459cbdc93b4fcba3f88a1a3d035dc3709f797f5cd32b4ac
- SSDEEP 1536:ehSSD9l2WCLdGgLtXpdTpalWDZVTHS0NyA244pSRWbDvL:ehB9wXJxZDpD7SG2pSROv
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\ExtMenu.fnr
- Size 172KB
- SHA256 01124785a2655469302f4e1a9aa8c2149f60eefedce1222434b9629932035ed3
- MD5 786f453ec7bc1b0faa9cd067b1445421
- SHA1 6e5a085381a11d9de10659fa78d209872d8b7dcd
- SHA512 b4dc10dfa087d3c476a29a3857f80bff81f37f95bbae7d64cce279225fc70dfa1753f976b849a72be5d568d88e7d04521497489d429bd0cdded2cb36a3e92356
- SSDEEP 3072:CT0q7BM8GJ8i4CQe0xR59u9BuuoBhSX3N2:C7VMoCgE9BusXd
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\SkinH_EL.dll
- Size 103KB
- SHA256 950b62955df1e6f1d99e6685a06f6c8b8e5ddb3236795719d4e8ee567617d3ee
- MD5 e8b0c3686c327cf22ded34567edb9059
- SHA1 1267f3c25a1faa0843553e2374853ee49fdcaa8c
- SHA512 1aba544df47ee1366c00782fc9a83a1fc11b6af032cce871f75b1a4512390bafd16027acf7f45f60fad9a8e5742b2deedf56abb60d5c69799090d57832934b1d
- SSDEEP 3072:Ec0hudNq06sqbkFx62+JitDMzN0FW+u5ckrNkoout8:EfhMq0K/JI9krNkooS
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\dp1.fne
- Size 112KB
- SHA256 fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
- MD5 6d4b2e73f6f8ecff02f19f7e8ef9a8c7
- SHA1 09c32ca167136a17fd69df8c525ea5ffeca6c534
- SHA512 2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
- SSDEEP 1536:IxM5MufmW0C3flmskqT0qYvwDr3cFoWPrE:IxMmomWP3fQEFrsFoWT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\edroptarget.fne
- Size 144KB
- SHA256 23a17adce02920c4fbfb62870073f5f585d332cf437b1e18d363822affef775e
- MD5 c054c9322fe658afca7a31cee39a839a
- SHA1 bb299b3fc2a0f0006e10bc6c5fbf22ae687dcfaa
- SHA512 2ccf00f3d8bec59032585fe988f5690f9028e5bddeb3b6254b7ed19a873dc2f33edf600e4b86f35f6a5223f11805bd376d2ed6ae561ba9345f29f360e5cc2342
- SSDEEP 3072:ibmuIEz3xfH7Ou7ke8BOlrjK0oWgVJuaQB6:yLtbOuMAuJ+
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\hfile.dll
- Size 44KB
- SHA256 80b9532d3e1f5146645038f38ace9e4132c6ad9cb44912407e6508bc5ccd6c5b
- MD5 8cc0e58b46dbf25e2666e7e40f613502
- SHA1 a1b327e7f5bfba78a8cf762e6dc360234551488b
- SHA512 686c7c840d16978ea17ca55aa0bdb64887e4caac5f2af18fbefb2b68549ac3f95ee93bf1e022e6b74e49f2343a6607817fc664b2919778ad88ed1c09e6bf919c
- SSDEEP 384:q3UsDuTfZSyixA8VpSbNBxql7n+w7jTcPh3zyYpV/sJuT8++/8oxZEs22:qraTxSPa8o3qlqw7SzVV/i3/8o
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\iext.fnr
- Size 212KB
- SHA256 7a27f0354e55162fcf4f90785c839b07ad7645117b4f1d7fdf004169e08a7381
- MD5 d147032073df12d9d35848b573dc552c
- SHA1 e9823b0f6ea6d316e94bdc9fe2e98a6316ac31c8
- SHA512 521c4a92bddc50bd9964388c48c6ff6478477690685a74976a928910bc7029418b24aef894ab54439dec7574fb2c3735898a71b9e2884e7efa1478909483c06c
- SSDEEP 3072:X/+z3cgIIL5f9Ys4Yv8GGICgR8G7zCDBc4o6lNs6RlxO2VK:S5WDGGt3s8
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\krnln.fnr
- Size 1.1MB
- SHA256 db32e8ea1d91009ca25b79d7e863a08be56632641a7a145326fbfbf0931b6c79
- MD5 3fe72f93ab5f24a0ea2d753013a41c4b
- SHA1 9206cd206c0b2782a2b1ad1d19ace97bae6e491e
- SHA512 24ce75304e6b5508d9bbf425a68b1907bc51f30c168dd3b800f34e1f7fc1aee044818848d1fde40e7556af5f16f94ea02d19344bd9ffda1a6d011a624d6f46e9
- SSDEEP 12288:Ck5jHwdO1b54cWOcmC8gxUZPzkweBQKdIbbXvwTJOK+A0tGE33Tam:EdOX4tmCLUZPYwYNIXvSJOK+ATE3ja
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lockfolder\shell.fne
- Size 40KB
- SHA256 192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9
- MD5 d54753e7fc3ea03aec0181447969c0e8
- SHA1 824e7007b6569ae36f174c146ae1b7242f98f734
- SHA512 c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f
- SSDEEP 768:Pw7QWaOn79Tm7UmuRDR73FjLo4RIqF6bw:Pw7579Tm7V4jxo4RIq0w
- MD5 SHA1 SHA512 SSDEEP