3968a850f5bc70d954bb5609d929f181a6f05a117fa3be4531cbd96cedfde5d6

Login
Reports

Overview

overview

Static

static

Builds.7z

windows7-x64

Builds.7z

windows10-2004-x64

Builds/ESX...me.zip

windows7-x64

Builds/ESX...me.zip

windows10-2004-x64

Builds/LBB...ad.zip

windows7-x64

Builds/LBB...ad.zip

windows10-2004-x64

LBB_PS1.ps1

windows7-x64

LBB_PS1.ps1

windows10-2004-x64

LBB_PS1_ob...ed.ps1

windows7-x64

LBB_PS1_ob...ed.ps1

windows10-2004-x64

LBB_PS1_pass.ps1

windows7-x64

LBB_PS1_pass.ps1

windows10-2004-x64

LBB_Reflec...in.dll

windows7-x64

LBB_Reflec...in.dll

windows10-2004-x64

LBB_Rundll32.dll

windows7-x64

LBB_Rundll32.dll

windows10-2004-x64

LBB_Rundll32_pass.dll

windows7-x64

LBB_Rundll32_pass.dll

windows10-2004-x64

LBB_pass.exe

windows7-x64

LBB_pass.exe

windows10-2004-x64

Password_dll.txt

windows7-x64

Password_dll.txt

windows10-2004-x64

Password_exe.txt

windows7-x64

Password_exe.txt

windows10-2004-x64

Password_ps1.txt

windows7-x64

Password_ps1.txt

windows10-2004-x64

Builds/LBG...ok.zip

windows7-x64

Builds/LBG...ok.zip

windows10-2004-x64

FC8E43EC21...32.exe

windows7-x64

FC8E43EC21...32.exe

windows10-2004-x64

FC8E43EC21...64.exe

windows7-x64

FC8E43EC21...64.exe

windows10-2004-x64

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2024, 22:23

Sharing

Copy URL Twitter E-mail

Static task

static1

3 signatures

lockbit

Behavioral task

behavioral1

Sample

Builds.7z

Resource

win7-20241010-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

Builds.7z

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

Builds/ESXi_vx-_____________329D6F9DDBF138D4_19.12.24_i_love_anime.zip

Resource

win7-20241010-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

Builds/ESXi_vx-_____________329D6F9DDBF138D4_19.12.24_i_love_anime.zip

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

Builds/LBB_vx-_____________07AAB9B790E0235B_19.12.24_hacking_is_bad.zip

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

Builds/LBB_vx-_____________07AAB9B790E0235B_19.12.24_hacking_is_bad.zip

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

LBB_PS1.ps1

Resource

win7-20240903-en

windows7-x64

8 signatures

150 seconds

discovery execution

Behavioral task

behavioral8

Sample

LBB_PS1.ps1

Resource

win10v2004-20241007-en

windows10-2004-x64

16 signatures

150 seconds

defense_evasion discovery execution ransomware

Behavioral task

behavioral9

Sample

LBB_PS1_obfuscated.ps1

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

execution

Behavioral task

behavioral10

Sample

LBB_PS1_obfuscated.ps1

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

execution

Behavioral task

behavioral11

Sample

LBB_PS1_pass.ps1

Resource

win7-20241023-en

windows7-x64

8 signatures

150 seconds

lockbit discovery execution ransomware

Behavioral task

behavioral12

Sample

LBB_PS1_pass.ps1

Resource

win10v2004-20241007-en

windows10-2004-x64

9 signatures

150 seconds

lockbit discovery execution ransomware

Behavioral task

behavioral13

Sample

LBB_ReflectiveDll_DllMain.dll

Resource

win7-20240903-en

windows7-x64

13 signatures

150 seconds

defense_evasion discovery ransomware

Behavioral task

behavioral14

Sample

LBB_ReflectiveDll_DllMain.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

12 signatures

150 seconds

defense_evasion discovery

Behavioral task

behavioral15

Sample

LBB_Rundll32.dll

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

discovery

Behavioral task

behavioral16

Sample

LBB_Rundll32.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

discovery

Behavioral task

behavioral17

Sample

LBB_Rundll32_pass.dll

Resource

win7-20240903-en

windows7-x64

5 signatures

150 seconds

lockbit discovery ransomware

Behavioral task

behavioral18

Sample

LBB_Rundll32_pass.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

5 signatures

150 seconds

lockbit discovery ransomware

Behavioral task

behavioral19

Sample

LBB_pass.exe

Resource

win7-20240729-en

windows7-x64

6 signatures

150 seconds

lockbit discovery ransomware

Behavioral task

behavioral20

Sample

LBB_pass.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

5 signatures

150 seconds

lockbit discovery ransomware

Behavioral task

behavioral21

Sample

Password_dll.txt

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

Password_dll.txt

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

Password_exe.txt

Resource

win7-20241010-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

Password_exe.txt

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

Password_ps1.txt

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

Password_ps1.txt

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

Builds/LBG_vx-_____________FC8E43EC21BE9047_19.12.24_hacking_is_illegal_ok.zip

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

Builds/LBG_vx-_____________FC8E43EC21BE9047_19.12.24_hacking_is_illegal_ok.zip

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

FC8E43EC21BE9047/lbg32.exe

Resource

win7-20240903-en

windows7-x64

9 signatures

150 seconds

discovery spyware stealer

Behavioral task

behavioral30

Sample

FC8E43EC21BE9047/lbg32.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

9 signatures

150 seconds

credential_access discovery stealer

Behavioral task

behavioral31

Sample

FC8E43EC21BE9047/lbg64.exe

Resource

win7-20240903-en

windows7-x64

9 signatures

150 seconds

credential_access discovery spyware stealer

Behavioral task

behavioral32

Sample

FC8E43EC21BE9047/lbg64.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

9 signatures

150 seconds

credential_access discovery spyware stealer

Report Analysis Logs

General

Target
Builds/ESXi_vx-_____________329D6F9DDBF138D4_19.12.24_i_love_anime.zip
Size 90KB
Sample241219-2a2s3sskck
SHA256 7818967ae2af71f292edd68b9811129706c160240d89babceb6ebe4ae0ff17d5
MD5 f8601b88d1abfe52654dd0726a930f22
SHA1 cf327abab426f1112be9907fa58dae0989f5642e
SHA512 2073e9697358767305c9c55a92d1335a7a20e0d03d2aea59d778038812100aba375e3d9d0367f2b50f24befa8e6cea559d6d86773902c00e3733f1b12a937f32
SSDEEP 1536:5ZaSAisBv/LXkouNev8Ge9bwwzl/njrq8Du2nFSHMx6eXAjZc/RDeJ6E5:56Bb0LNlGAbBNjO8DuWSHMxnXAQM6y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4028	7zFM.exe
Token: 35	4028	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4028	7zFM.exe

Processes

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Builds\ESXi_vx-_____________329D6F9DDBF138D4_19.12.24_i_love_anime.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4028

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads