Analysis
-
max time kernel
151s -
max time network
21s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-05-2021 08:21
Static task
static1
Behavioral task
behavioral1
Sample
LegionLocker3.0.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
LegionLocker3.0.exe
-
Size
3.0MB
-
MD5
cdccf5b587aac1a4aeb53f8aaa465759
-
SHA1
3d804d15282a5b031684cc6bd8b9b7d9d880d13d
-
SHA256
f6289c13d79d8de611e9c143602298970b5969c15a4d6a3e40efec794bc371dd
-
SHA512
61668842acbb52c8c1e35e5ba4cca412ea1a56b4de6e3adb58f158cee77f8e04e24be99bbbc92c5f551afc2bbe45cf9c99c7b0b63affb8cef3d6718dc0c950f3
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\LegionReadMe.txt
Ransom Note
Ooops! All your important files are encrypted!
What happend to my computer?
All your important files are encrypted. No one can help you to restore files without our special decryptor
Backups were either encrypted or deleted. Shadow copies also removed.
If you want to restore some of your files for free write to email (contact is below)
and attach 2-3 encrypted files.
You will receive decrypted samples.
Please don't forget to attach ID.txt file in the e-mail.
To decrypt other files you have to pay $50.
How do i pay?
Payment is accepted in Bitcoin only.
Please check the current price of Bitcoin and buy some Bitcoins.
And send the correct amount to the address specified at the bottom of the sheet.
Contact:
1.Download Tor browser (https://www.torproject.org/)
2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/)
3.Write email to us ([email protected])
In case of no anwser in 72 hours write us to this email: [email protected]
What if i already paid?
Send your Bitcoin wallet ID to e-mail provided above.
Attention!
1.Do not modify encrypted files.
2.Do not try decrypt your data using third party software, it may cause pernament data loss.
Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
Wallets
131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
URLs
http://mail2tor2zyjdctd.onion/
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LegionLocker3.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LegionLocker3.0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/308-62-0x00000000001B0000-0x00000000001B1000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LegionLocker3.0.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 308 LegionLocker3.0.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1652 vssadmin.exe 1500 vssadmin.exe 1840 vssadmin.exe 484 vssadmin.exe 1480 vssadmin.exe 336 vssadmin.exe 1952 vssadmin.exe 1828 vssadmin.exe 1608 vssadmin.exe 1616 vssadmin.exe 1164 vssadmin.exe 472 vssadmin.exe 1000 vssadmin.exe 1896 vssadmin.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1348 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe 308 LegionLocker3.0.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 308 LegionLocker3.0.exe Token: SeBackupPrivilege 1504 vssvc.exe Token: SeRestorePrivilege 1504 vssvc.exe Token: SeAuditPrivilege 1504 vssvc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1348 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 308 wrote to memory of 848 308 LegionLocker3.0.exe 29 PID 308 wrote to memory of 848 308 LegionLocker3.0.exe 29 PID 308 wrote to memory of 848 308 LegionLocker3.0.exe 29 PID 308 wrote to memory of 848 308 LegionLocker3.0.exe 29 PID 848 wrote to memory of 1652 848 cmd.exe 31 PID 848 wrote to memory of 1652 848 cmd.exe 31 PID 848 wrote to memory of 1652 848 cmd.exe 31 PID 848 wrote to memory of 1652 848 cmd.exe 31 PID 848 wrote to memory of 484 848 cmd.exe 33 PID 848 wrote to memory of 484 848 cmd.exe 33 PID 848 wrote to memory of 484 848 cmd.exe 33 PID 848 wrote to memory of 484 848 cmd.exe 33 PID 848 wrote to memory of 1480 848 cmd.exe 34 PID 848 wrote to memory of 1480 848 cmd.exe 34 PID 848 wrote to memory of 1480 848 cmd.exe 34 PID 848 wrote to memory of 1480 848 cmd.exe 34 PID 848 wrote to memory of 1164 848 cmd.exe 35 PID 848 wrote to memory of 1164 848 cmd.exe 35 PID 848 wrote to memory of 1164 848 cmd.exe 35 PID 848 wrote to memory of 1164 848 cmd.exe 35 PID 848 wrote to memory of 336 848 cmd.exe 36 PID 848 wrote to memory of 336 848 cmd.exe 36 PID 848 wrote to memory of 336 848 cmd.exe 36 PID 848 wrote to memory of 336 848 cmd.exe 36 PID 848 wrote to memory of 472 848 cmd.exe 37 PID 848 wrote to memory of 472 848 cmd.exe 37 PID 848 wrote to memory of 472 848 cmd.exe 37 PID 848 wrote to memory of 472 848 cmd.exe 37 PID 848 wrote to memory of 1000 848 cmd.exe 38 PID 848 wrote to memory of 1000 848 cmd.exe 38 PID 848 wrote to memory of 1000 848 cmd.exe 38 PID 848 wrote to memory of 1000 848 cmd.exe 38 PID 848 wrote to memory of 1896 848 cmd.exe 39 PID 848 wrote to memory of 1896 848 cmd.exe 39 PID 848 wrote to memory of 1896 848 cmd.exe 39 PID 848 wrote to memory of 1896 848 cmd.exe 39 PID 848 wrote to memory of 1828 848 cmd.exe 40 PID 848 wrote to memory of 1828 848 cmd.exe 40 PID 848 wrote to memory of 1828 848 cmd.exe 40 PID 848 wrote to memory of 1828 848 cmd.exe 40 PID 848 wrote to memory of 1952 848 cmd.exe 41 PID 848 wrote to memory of 1952 848 cmd.exe 41 PID 848 wrote to memory of 1952 848 cmd.exe 41 PID 848 wrote to memory of 1952 848 cmd.exe 41 PID 848 wrote to memory of 1616 848 cmd.exe 42 PID 848 wrote to memory of 1616 848 cmd.exe 42 PID 848 wrote to memory of 1616 848 cmd.exe 42 PID 848 wrote to memory of 1616 848 cmd.exe 42 PID 848 wrote to memory of 1500 848 cmd.exe 43 PID 848 wrote to memory of 1500 848 cmd.exe 43 PID 848 wrote to memory of 1500 848 cmd.exe 43 PID 848 wrote to memory of 1500 848 cmd.exe 43 PID 848 wrote to memory of 1608 848 cmd.exe 44 PID 848 wrote to memory of 1608 848 cmd.exe 44 PID 848 wrote to memory of 1608 848 cmd.exe 44 PID 848 wrote to memory of 1608 848 cmd.exe 44 PID 848 wrote to memory of 1840 848 cmd.exe 45 PID 848 wrote to memory of 1840 848 cmd.exe 45 PID 848 wrote to memory of 1840 848 cmd.exe 45 PID 848 wrote to memory of 1840 848 cmd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\LegionLocker3.0.exe"C:\Users\Admin\AppData\Local\Temp\LegionLocker3.0.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WTHBNZD.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1652
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:484
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1480
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1164
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:336
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:472
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1000
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1896
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1828
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1952
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1616
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1500
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1608
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1840
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1556
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LegionReadMe.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1348
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:368