Overview

overview

10

Static

static

10

lk.exe

windows10-2004-x64

9

Resubmissions

26-09-2024 23:34

240926-3ktqwsteqq 10

02-09-2024 12:26

240902-pl9xls1cnb 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lk.exe

  • Size

    146KB

  • Sample

    240926-3ktqwsteqq

  • MD5

    7f6830b77ad13b244bc5d702d67137bf

  • SHA1

    1fbd763388a3e9679ac66b35da8a78e041611fe4

  • SHA256

    e097f98ea3416330ed2fd7856743d68a7ca880c6d57e8c264a384a112ac5a390

  • SHA512

    488cb83c7267cfc70989e09489373f4372325531f7c02b1711fbdf6dfeaa377c39b84d5e971136e0e41d0a6dcde52ec4d21a749169eedb9e9ba43eb9caf077de

  • SSDEEP

    3072:c6glyuxE4GsUPnliByocWep0XL63DjDeprS:c6gDBGpvEByocWeOmuNS

Score
10/10
lockbitdiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target

      lk.exe

    • Size

      146KB

    • MD5

      7f6830b77ad13b244bc5d702d67137bf

    • SHA1

      1fbd763388a3e9679ac66b35da8a78e041611fe4

    • SHA256

      e097f98ea3416330ed2fd7856743d68a7ca880c6d57e8c264a384a112ac5a390

    • SHA512

      488cb83c7267cfc70989e09489373f4372325531f7c02b1711fbdf6dfeaa377c39b84d5e971136e0e41d0a6dcde52ec4d21a749169eedb9e9ba43eb9caf077de

    • SSDEEP

      3072:c6glyuxE4GsUPnliByocWep0XL63DjDeprS:c6gDBGpvEByocWeOmuNS

    Score
    9/10
    discoveryransomwarespywarestealer

    • Renames multiple (605) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks