Static task
static1
Behavioral task
behavioral1
Sample
2024-06-20_7021fda2c2246666ad9077f408fc8171_lockbit.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-20_7021fda2c2246666ad9077f408fc8171_lockbit.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-20_7021fda2c2246666ad9077f408fc8171_lockbit
-
Size
862KB
-
MD5
7021fda2c2246666ad9077f408fc8171
-
SHA1
2493affe8c14d21c741c8fd45d4b94358c543dc2
-
SHA256
1b2176a06a4ba25c4a15a3a2b1da83bc7abe078a76892ba14c2a2f95a9c10d48
-
SHA512
fcc558870d05c0b3cee10f8d69f20d10bdfd9039e0b64036156d3d0dd45f69933b0c89d687095d8c9eb62ea5914954ceb58a0c12fef14740447d176486a02c6f
-
SSDEEP
24576:7xAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QHF:1AfSrWW4g+7Ht+UmxJeU
Malware Config
Signatures
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
Processes:
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
Processes:
resource yara_rule sample INDICATOR_SUSPICIOUS_USNDeleteJournal -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-06-20_7021fda2c2246666ad9077f408fc8171_lockbit
Files
-
2024-06-20_7021fda2c2246666ad9077f408fc8171_lockbit.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 804KB - Virtual size: 803KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE