ff652f97ac93507e30fca7446d266d82e5ad1ca4066b1e5dc81b5e3256e393b4 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 16:00

Sharing

Report Analysis Logs

General

Target

LockBit-main.zip
Size

3.4MB
MD5

48c928de6458fac060c281e3febc1a15
SHA1

e6ed8102960a159063edd62695926d16be32ce60
SHA256

ff652f97ac93507e30fca7446d266d82e5ad1ca4066b1e5dc81b5e3256e393b4
SHA512

01abc3d99d8ecb19991a0a70c5e10fb4b86b70edcf1492d9827edd72e70fb1c2596ab6e49261bc31965fb68be8749fb622bf3050458eb44aec9230f567228daf
SSDEEP

98304:1TKYu1ibTKwig1isTKQTK3D1i5I39BPiv12FpQiwilbl4:1OYu1sOng1tOQO3D1CI3Tg1epQiwsba

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
2288	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	2288	7zFM.exe
Token: 35	2288	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid	Process
2288	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\LockBit-main.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads