Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06-02-2022 22:29
Static task
static1
Behavioral task
behavioral1
Sample
LegionLocker.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
LegionLocker.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
LegionLocker.exe
-
Size
3.4MB
-
MD5
ff781960baad7ac1974e254bbc7d8044
-
SHA1
263450e71b84d608d40448c73add2719875c4732
-
SHA256
9d13fde85da13d3c9533ace39fdfb71c95419f002c946265e6d12030890d8b9d
-
SHA512
fc572d058d0c4782621d069cc9d16b575363bdd51a3d50bedc4b91b12c0e6ac6d93256ae9266c5cac17878dd0da474477bc283735e8d4decf206e68150495d8a
Score
10/10
Malware Config
Signatures
-
Detected LegionLocker ransomware 3 IoCs
Sample contains strings associated with the LegionLocker family.
resource yara_rule behavioral1/files/0x000800000001226a-57.dat family_legionlocker behavioral1/files/0x000800000001226a-58.dat family_legionlocker behavioral1/files/0x000800000001226a-60.dat family_legionlocker -
LegionLocker
Ransomware family active in 2021.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 1684 LegionL0cker.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SwitchBlock.tif => C:\Users\Admin\Pictures\SwitchBlock.tif.lock LegionL0cker.exe File opened for modification C:\Users\Admin\Pictures\UseLimit.tiff LegionL0cker.exe File renamed C:\Users\Admin\Pictures\UseLimit.tiff => C:\Users\Admin\Pictures\UseLimit.tiff.lock LegionL0cker.exe File renamed C:\Users\Admin\Pictures\InstallTrace.tif => C:\Users\Admin\Pictures\InstallTrace.tif.lock LegionL0cker.exe File renamed C:\Users\Admin\Pictures\NewEnable.png => C:\Users\Admin\Pictures\NewEnable.png.lock LegionL0cker.exe File opened for modification C:\Users\Admin\Pictures\ResetDismount.tiff LegionL0cker.exe File renamed C:\Users\Admin\Pictures\ResetDismount.tiff => C:\Users\Admin\Pictures\ResetDismount.tiff.lock LegionL0cker.exe File renamed C:\Users\Admin\Pictures\ExitOut.raw => C:\Users\Admin\Pictures\ExitOut.raw.lock LegionL0cker.exe File renamed C:\Users\Admin\Pictures\PingBlock.png => C:\Users\Admin\Pictures\PingBlock.png.lock LegionL0cker.exe File renamed C:\Users\Admin\Pictures\RenameClear.tif => C:\Users\Admin\Pictures\RenameClear.tif.lock LegionL0cker.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LegionL0cker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LegionL0cker.exe -
Loads dropped DLL 1 IoCs
pid Process 2044 LegionLocker.exe -
resource yara_rule behavioral1/files/0x000800000001226a-57.dat themida behavioral1/files/0x000800000001226a-58.dat themida behavioral1/files/0x000800000001226a-60.dat themida behavioral1/memory/1684-64-0x0000000000010000-0x00000000008E4000-memory.dmp themida behavioral1/memory/1684-65-0x0000000000010000-0x00000000008E4000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LegionL0cker.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1684 LegionL0cker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 564 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe 1684 LegionL0cker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1684 LegionL0cker.exe Token: SeDebugPrivilege 564 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1684 2044 LegionLocker.exe 27 PID 2044 wrote to memory of 1684 2044 LegionLocker.exe 27 PID 2044 wrote to memory of 1684 2044 LegionLocker.exe 27 PID 2044 wrote to memory of 1684 2044 LegionLocker.exe 27 PID 1684 wrote to memory of 268 1684 LegionL0cker.exe 28 PID 1684 wrote to memory of 268 1684 LegionL0cker.exe 28 PID 1684 wrote to memory of 268 1684 LegionL0cker.exe 28 PID 1684 wrote to memory of 268 1684 LegionL0cker.exe 28 PID 268 wrote to memory of 564 268 cmd.exe 30 PID 268 wrote to memory of 564 268 cmd.exe 30 PID 268 wrote to memory of 564 268 cmd.exe 30 PID 268 wrote to memory of 564 268 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\LegionLocker.exe"C:\Users\Admin\AppData\Local\Temp\LegionLocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe"C:\Users\Admin\AppData\Local\Temp\LegionL0cker.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k color 47 && taskkill /f /im explorer.exe && Exit3⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
-