Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 08:21
Static task
static1
Behavioral task
behavioral1
Sample
LegionLocker3.0.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
LegionLocker3.0.exe
-
Size
3.0MB
-
MD5
cdccf5b587aac1a4aeb53f8aaa465759
-
SHA1
3d804d15282a5b031684cc6bd8b9b7d9d880d13d
-
SHA256
f6289c13d79d8de611e9c143602298970b5969c15a4d6a3e40efec794bc371dd
-
SHA512
61668842acbb52c8c1e35e5ba4cca412ea1a56b4de6e3adb58f158cee77f8e04e24be99bbbc92c5f551afc2bbe45cf9c99c7b0b63affb8cef3d6718dc0c950f3
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\LegionReadMe.txt
Ransom Note
Ooops! All your important files are encrypted!
What happend to my computer?
All your important files are encrypted. No one can help you to restore files without our special decryptor
Backups were either encrypted or deleted. Shadow copies also removed.
If you want to restore some of your files for free write to email (contact is below)
and attach 2-3 encrypted files.
You will receive decrypted samples.
Please don't forget to attach ID.txt file in the e-mail.
To decrypt other files you have to pay $50.
How do i pay?
Payment is accepted in Bitcoin only.
Please check the current price of Bitcoin and buy some Bitcoins.
And send the correct amount to the address specified at the bottom of the sheet.
Contact:
1.Download Tor browser (https://www.torproject.org/)
2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/)
3.Write email to us ([email protected])
In case of no anwser in 72 hours write us to this email: [email protected]
What if i already paid?
Send your Bitcoin wallet ID to e-mail provided above.
Attention!
1.Do not modify encrypted files.
2.Do not try decrypt your data using third party software, it may cause pernament data loss.
Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
Wallets
131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
URLs
http://mail2tor2zyjdctd.onion/
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExportBlock.raw => C:\Users\Admin\Pictures\ExportBlock.raw.LGNLCKD LegionLocker3.0.exe File renamed C:\Users\Admin\Pictures\SelectUnpublish.crw => C:\Users\Admin\Pictures\SelectUnpublish.crw.LGNLCKD LegionLocker3.0.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LegionLocker3.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LegionLocker3.0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3156-115-0x0000000001070000-0x0000000001071000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LegionLocker3.0.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3156 LegionLocker3.0.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3280 vssadmin.exe 3968 vssadmin.exe 3976 vssadmin.exe 3724 vssadmin.exe 3032 vssadmin.exe 992 vssadmin.exe 1280 vssadmin.exe 2488 vssadmin.exe 3704 vssadmin.exe 3120 vssadmin.exe 2108 vssadmin.exe 2924 vssadmin.exe 3900 vssadmin.exe 2372 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe 3156 LegionLocker3.0.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3156 LegionLocker3.0.exe Token: SeBackupPrivilege 2872 vssvc.exe Token: SeRestorePrivilege 2872 vssvc.exe Token: SeAuditPrivilege 2872 vssvc.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 3156 wrote to memory of 188 3156 LegionLocker3.0.exe 76 PID 3156 wrote to memory of 188 3156 LegionLocker3.0.exe 76 PID 3156 wrote to memory of 188 3156 LegionLocker3.0.exe 76 PID 188 wrote to memory of 1280 188 cmd.exe 78 PID 188 wrote to memory of 1280 188 cmd.exe 78 PID 188 wrote to memory of 1280 188 cmd.exe 78 PID 188 wrote to memory of 3280 188 cmd.exe 80 PID 188 wrote to memory of 3280 188 cmd.exe 80 PID 188 wrote to memory of 3280 188 cmd.exe 80 PID 188 wrote to memory of 3120 188 cmd.exe 81 PID 188 wrote to memory of 3120 188 cmd.exe 81 PID 188 wrote to memory of 3120 188 cmd.exe 81 PID 188 wrote to memory of 3968 188 cmd.exe 82 PID 188 wrote to memory of 3968 188 cmd.exe 82 PID 188 wrote to memory of 3968 188 cmd.exe 82 PID 188 wrote to memory of 2108 188 cmd.exe 83 PID 188 wrote to memory of 2108 188 cmd.exe 83 PID 188 wrote to memory of 2108 188 cmd.exe 83 PID 188 wrote to memory of 2924 188 cmd.exe 84 PID 188 wrote to memory of 2924 188 cmd.exe 84 PID 188 wrote to memory of 2924 188 cmd.exe 84 PID 188 wrote to memory of 3900 188 cmd.exe 85 PID 188 wrote to memory of 3900 188 cmd.exe 85 PID 188 wrote to memory of 3900 188 cmd.exe 85 PID 188 wrote to memory of 2372 188 cmd.exe 86 PID 188 wrote to memory of 2372 188 cmd.exe 86 PID 188 wrote to memory of 2372 188 cmd.exe 86 PID 188 wrote to memory of 2488 188 cmd.exe 87 PID 188 wrote to memory of 2488 188 cmd.exe 87 PID 188 wrote to memory of 2488 188 cmd.exe 87 PID 188 wrote to memory of 3704 188 cmd.exe 88 PID 188 wrote to memory of 3704 188 cmd.exe 88 PID 188 wrote to memory of 3704 188 cmd.exe 88 PID 188 wrote to memory of 3976 188 cmd.exe 89 PID 188 wrote to memory of 3976 188 cmd.exe 89 PID 188 wrote to memory of 3976 188 cmd.exe 89 PID 188 wrote to memory of 3032 188 cmd.exe 90 PID 188 wrote to memory of 3032 188 cmd.exe 90 PID 188 wrote to memory of 3032 188 cmd.exe 90 PID 188 wrote to memory of 3724 188 cmd.exe 91 PID 188 wrote to memory of 3724 188 cmd.exe 91 PID 188 wrote to memory of 3724 188 cmd.exe 91 PID 188 wrote to memory of 992 188 cmd.exe 92 PID 188 wrote to memory of 992 188 cmd.exe 92 PID 188 wrote to memory of 992 188 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\LegionLocker3.0.exe"C:\Users\Admin\AppData\Local\Temp\LegionLocker3.0.exe"1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WTHBNZD.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1280
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:3280
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:3120
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3968
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2108
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2924
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3900
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2372
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2488
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3704
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3976
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3032
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3724
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:992
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872