Analysis
- max time kernel
150s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
26/03/2021, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
LegionLocker.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
LegionLocker.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target LegionLocker.exe
- Size 3.1MB
- Sample210326-81cwbeya4x
- SHA256 4cfb6842146846fca052d82cc0f80e23c3a7b23bd5958aecfa6a21e28825a1f0
- MD5 d48b80eadbbe9bfb68f3fbe11a6cf0e5
- SHA1 c099a07b701c1f06709e181481a5938f9b6e001a
- SHA512 18aede3c47814d5a53dafaeab24da4a322ac8ed079640938cba4027903c07e524fee6f7746d0fdfc996bc9ad208441c6f11565fe56d603567d7cdefe4f8389ea
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisconnectCompress.tif => C:\Users\Admin\Pictures\DisconnectCompress.tif.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\ExitEnable.raw => C:\Users\Admin\Pictures\ExitEnable.raw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\RevokeMove.png => C:\Users\Admin\Pictures\RevokeMove.png.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\AddProtect.raw => C:\Users\Admin\Pictures\AddProtect.raw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\AssertShow.tif => C:\Users\Admin\Pictures\AssertShow.tif.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\CloseComplete.crw => C:\Users\Admin\Pictures\CloseComplete.crw.lock LegionLocker.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LegionLocker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LegionLocker.exe -
resource yara_rule behavioral2/memory/4776-4-0x0000000000FB0000-0x0000000000FB1000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LegionLocker.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini LegionLocker.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4776 LegionLocker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Kills process with taskkill 1 IoCs
pid Process 4416 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe 4776 LegionLocker.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4416 taskkill.exe Token: SeDebugPrivilege 4776 LegionLocker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4776 wrote to memory of 4000 4776 LegionLocker.exe 75 PID 4776 wrote to memory of 4000 4776 LegionLocker.exe 75 PID 4776 wrote to memory of 4000 4776 LegionLocker.exe 75 PID 4000 wrote to memory of 4416 4000 cmd.exe 77 PID 4000 wrote to memory of 4416 4000 cmd.exe 77 PID 4000 wrote to memory of 4416 4000 cmd.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\LegionLocker.exe"C:\Users\Admin\AppData\Local\Temp\LegionLocker.exe"1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k color 47 && taskkill /f /im explorer.exe && Exit2⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-