Analysis
-
max time kernel
136s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lock.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lock.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Lock.exe
-
Size
16KB
-
MD5
683bcb1f86f4410931abe39a63eb7057
-
SHA1
d338aac5ff479fc94d3c840e862665de1dac8c8f
-
SHA256
c9f03a39789f7322ae43604db6ce7da86765ad4b13207091683cf47bdea8de12
-
SHA512
60b596947d93fdb196fcf338af92d26cdd82396283316352ead078ce1a85943bb85264901318f7061e6b0e49058ace521831a9275c025526373d9168c757cdd2
-
SSDEEP
384:wi9N5yF4C0n7QLweis5rul02mXlBbVVaXI:wi3kWv7UB92KaXI
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2972 Lock.exe 2972 Lock.exe 2972 Lock.exe 2972 Lock.exe 2972 Lock.exe 2972 Lock.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2760 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2972 Lock.exe Token: SeDebugPrivilege 2760 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe 2760 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lock.exe"C:\Users\Admin\AppData\Local\Temp\Lock.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\RestoreExit.cmd" "1⤵PID:584
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760