Analysis
-
max time kernel
603s -
max time network
361s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08-02-2022 13:26
Static task
static1
Behavioral task
behavioral1
Sample
LegionLocker.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
LegionLocker.exe
Resource
win10v2004-en-20220112
General
-
Target
LegionLocker.exe
-
Size
6.6MB
-
MD5
9a72a508fcee3de957167a386f173c44
-
SHA1
55650582fc704d27cd7d95f971b0ddd13dcd9eaf
-
SHA256
22b1a6c34e47c23083fc1d2e3d01bc9dbd3fd4429e13aad6797ad41313447708
-
SHA512
fb8073e5d0c14dbe1780bed15b6a492c0db386acb56b834f56eae9d76cf9872dd95396fd8d6d06048864227fcc90f8cae9d7853169536835a183ea2099994262
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
LegionLocker.exedescription ioc process File renamed C:\Users\Admin\Pictures\SearchMove.png => C:\Users\Admin\Pictures\SearchMove.png.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\UndoNew.tif => C:\Users\Admin\Pictures\UndoNew.tif.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\CheckpointOpen.png => C:\Users\Admin\Pictures\CheckpointOpen.png.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\ConvertFromPing.crw => C:\Users\Admin\Pictures\ConvertFromPing.crw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\CopyUndo.crw => C:\Users\Admin\Pictures\CopyUndo.crw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\RevokeFind.crw => C:\Users\Admin\Pictures\RevokeFind.crw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\JoinAdd.raw => C:\Users\Admin\Pictures\JoinAdd.raw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\ReadWatch.raw => C:\Users\Admin\Pictures\ReadWatch.raw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\CheckpointResume.crw => C:\Users\Admin\Pictures\CheckpointResume.crw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\CompareImport.raw => C:\Users\Admin\Pictures\CompareImport.raw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\ConvertFromSet.raw => C:\Users\Admin\Pictures\ConvertFromSet.raw.lock LegionLocker.exe File renamed C:\Users\Admin\Pictures\DisableSplit.crw => C:\Users\Admin\Pictures\DisableSplit.crw.lock LegionLocker.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
LegionLocker.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LegionLocker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LegionLocker.exe -
Processes:
resource yara_rule behavioral1/memory/1628-62-0x00000000009C0000-0x0000000001294000-memory.dmp themida behavioral1/memory/1628-63-0x00000000009C0000-0x0000000001294000-memory.dmp themida -
Processes:
LegionLocker.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LegionLocker.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
LegionLocker.exepid process 1628 LegionLocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 664 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LegionLocker.exepid process 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe 1628 LegionLocker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
LegionLocker.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1628 LegionLocker.exe Token: SeDebugPrivilege 664 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
LegionLocker.execmd.exedescription pid process target process PID 1628 wrote to memory of 568 1628 LegionLocker.exe cmd.exe PID 1628 wrote to memory of 568 1628 LegionLocker.exe cmd.exe PID 1628 wrote to memory of 568 1628 LegionLocker.exe cmd.exe PID 1628 wrote to memory of 568 1628 LegionLocker.exe cmd.exe PID 568 wrote to memory of 664 568 cmd.exe taskkill.exe PID 568 wrote to memory of 664 568 cmd.exe taskkill.exe PID 568 wrote to memory of 664 568 cmd.exe taskkill.exe PID 568 wrote to memory of 664 568 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LegionLocker.exe"C:\Users\Admin\AppData\Local\Temp\LegionLocker.exe"1⤵
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k color 47 && taskkill /f /im explorer.exe && Exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-54-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB
-
memory/1628-55-0x00000000765F0000-0x0000000076700000-memory.dmpFilesize
1.1MB
-
memory/1628-56-0x00000000765F0000-0x0000000076700000-memory.dmpFilesize
1.1MB
-
memory/1628-58-0x0000000074FD0000-0x0000000075017000-memory.dmpFilesize
284KB
-
memory/1628-60-0x0000000074FD0000-0x0000000075017000-memory.dmpFilesize
284KB
-
memory/1628-61-0x0000000076EF0000-0x0000000077070000-memory.dmpFilesize
1.5MB
-
memory/1628-62-0x00000000009C0000-0x0000000001294000-memory.dmpFilesize
8.8MB
-
memory/1628-63-0x00000000009C0000-0x0000000001294000-memory.dmpFilesize
8.8MB
-
memory/1628-64-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/1628-65-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/1628-66-0x0000000005965000-0x0000000005976000-memory.dmpFilesize
68KB
-
memory/1628-67-0x0000000005976000-0x0000000005977000-memory.dmpFilesize
4KB
-
memory/1628-68-0x0000000005977000-0x0000000005978000-memory.dmpFilesize
4KB