Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 18:32
Static task
static1
Behavioral task
behavioral1
Sample
LockScreen.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
LockScreen.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240704-en
General
-
Target
LockScreen.exe
-
Size
312KB
-
MD5
40518699f3648f8bdb5f99b7d49a528f
-
SHA1
8a8f65182059965a9dfe9a3db2daf421648d8d79
-
SHA256
e4f5f4b4f6553afb6e2f6fdda5ddfa866810d6641a53ebee7bd6aa7a0df996f4
-
SHA512
afc87e0b0372004589fbd4fef68254401fe5e7c3f60a4280001b43b948e54e4616e7c445d7c7b2d363400ecb6d13c49f494a0e5403bc50ef73d29e39147e9c6e
-
SSDEEP
3072:TS1FyD0JkP1vp/3/zM57VVAK/IBRJ3o3gBRnoBhQYAR1FyD0JkP1u:TH/LMUBRJ4QBRoB0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LockScreen.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2744 LockScreen.exe Token: SeIncBasePriorityPrivilege 2744 LockScreen.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2744 LockScreen.exe 2744 LockScreen.exe 2744 LockScreen.exe