Analysis
- max time kernel
188s - max time network
189s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
12/10/2022, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
LB3.bin.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
LB3.bin.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target LB3.bin.exe
- Size 146KB
- Sample221012-bnc4rscaf7
- SHA256 f0c28f1bdb04716d12a2b05fa087bc51737343136b6673a010c5275383aeb686
- MD5 83cdd9b0a98a2499efa63206764d7951
- SHA1 ba957170234d2f35cd3d3c516614bbd0d417fcf9
- SHA512 27b74ca73b0b7c8e78bd86dae4a52bb2e071eaa48b2a8bf5c3611611b0e5403b342d6a03bc628bd1c3f0a99092477452a02d660b3ec75b63c4812cde19166782
- SSDEEP 3072:J6glyuxE4GsUPnliByocWepeMaUC56va7bmdSK0dd:J6gDBGpvEByocWeEzUvi+Wd
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\tnwdIrTIi.README.txt
Ransom Note
- ~~~ {#!GetLucky} Why do we use it ~~~ >>>> Your data are st0len and encrypted If you want to contact us, write in protonmail. Send bitcoins 0,000053 = USD $500 to this wallet or your personal data will be exposed. Bitcoin Address: bc1q6r50e40c40lwgs50yzt3drtpmel99j2qdtudl3 >>>> Your personal DECRYPTION ID: 49A7F649B5CD657C408B18D3F5E4DC70 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
Signatures
- Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\UseImport.tiff LB3.bin.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini LB3.bin.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tnwdIrTIi LB3.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tnwdIrTIi\ = "tnwdIrTIi" LB3.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tnwdIrTIi\DefaultIcon LB3.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tnwdIrTIi LB3.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tnwdIrTIi\DefaultIcon\ = "C:\\ProgramData\\tnwdIrTIi.ico" LB3.bin.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe 4912 LB3.bin.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4912 LB3.bin.exe Token: SeBackupPrivilege 4912 LB3.bin.exe Token: SeDebugPrivilege 4912 LB3.bin.exe Token: 36 4912 LB3.bin.exe Token: SeImpersonatePrivilege 4912 LB3.bin.exe Token: SeIncBasePriorityPrivilege 4912 LB3.bin.exe Token: SeIncreaseQuotaPrivilege 4912 LB3.bin.exe Token: 33 4912 LB3.bin.exe Token: SeManageVolumePrivilege 4912 LB3.bin.exe Token: SeProfSingleProcessPrivilege 4912 LB3.bin.exe Token: SeRestorePrivilege 4912 LB3.bin.exe Token: SeSecurityPrivilege 4912 LB3.bin.exe Token: SeSystemProfilePrivilege 4912 LB3.bin.exe Token: SeTakeOwnershipPrivilege 4912 LB3.bin.exe Token: SeShutdownPrivilege 4912 LB3.bin.exe Token: SeDebugPrivilege 4912 LB3.bin.exe Token: SeBackupPrivilege 1908 vssvc.exe Token: SeRestorePrivilege 1908 vssvc.exe Token: SeAuditPrivilege 1908 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.bin.exe"C:\Users\Admin\AppData\Local\Temp\LB3.bin.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\AAAAAAAAAAA
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\BBBBBBBBBBB
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\CCCCCCCCCCC
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\DDDDDDDDDDD
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\EEEEEEEEEEE
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\FFFFFFFFFFF
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\GGGGGGGGGGG
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\HHHHHHHHHHH
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\IIIIIIIIIII
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\JJJJJJJJJJJ
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\KKKKKKKKKKK
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\LLLLLLLLLLL
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\MMMMMMMMMMM
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\NNNNNNNNNNN
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\OOOOOOOOOOO
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\PPPPPPPPPPP
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\QQQQQQQQQQQ
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\RRRRRRRRRRR
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\SSSSSSSSSSS
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\TTTTTTTTTTT
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\UUUUUUUUUUU
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\VVVVVVVVVVV
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\WWWWWWWWWWW
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\XXXXXXXXXXX
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\YYYYYYYYYYY
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512
- Path C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini
- Size 129B
- SHA256 745d4e2e9f3232df90f5b1a22b121839d0834241039153d2684bc3da48be4a9d
- MD5 a1327a6d28060ccee240d113e0c629ac
- SHA1 2ed322d2bd2d0874416c6653901d0f39f359848f
- SHA512 7788d924534e139948b38ba662fca9568b53f80280ea5975aea788056581681170d6a50dd4804d46f3eebb27a5267ccd8ed528b1b51dd79b0805f17eb4c065e3
- MD5 SHA1 SHA512