Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2023, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
lbcr.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
lbcr.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
lbcr.exe
-
Size
347KB
-
MD5
dafc8e7ccd381af36f19267a2a9b3f9b
-
SHA1
742c9021f4f0fb264c32a59a66e3ac514b8e166b
-
SHA256
3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf
-
SHA512
70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e
-
SSDEEP
6144:58CS6KWJ0XJWcPZ1PiqbeiS8XDMs9HHCUA:KC9IgWrPiN0YEHHFA
Score
10/10
Malware Config
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Disables Task Manager via registry modification
-
Executes dropped EXE 4 IoCs
pid Process 1740 lbcr.exe 424 lbcr.exe 4980 lbcr.exe 4760 lbcr.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DenyPublish.crw => C:\Users\Admin\Pictures\DenyPublish.crw.ecrp lbcr.exe File opened for modification C:\Users\Admin\Pictures\RestorePush.tiff lbcr.exe File renamed C:\Users\Admin\Pictures\RestorePush.tiff => C:\Users\Admin\Pictures\RestorePush.tiff.ecrp lbcr.exe File renamed C:\Users\Admin\Pictures\SearchWait.tif => C:\Users\Admin\Pictures\SearchWait.tif.ecrp lbcr.exe File opened for modification C:\Users\Admin\Pictures\SkipExit.tiff lbcr.exe File renamed C:\Users\Admin\Pictures\SkipExit.tiff => C:\Users\Admin\Pictures\SkipExit.tiff.ecrp lbcr.exe File renamed C:\Users\Admin\Pictures\CloseStep.crw => C:\Users\Admin\Pictures\CloseStep.crw.ecrp lbcr.exe File renamed C:\Users\Admin\Pictures\LimitOptimize.png => C:\Users\Admin\Pictures\LimitOptimize.png.ecrp lbcr.exe File renamed C:\Users\Admin\Pictures\ProtectImport.png => C:\Users\Admin\Pictures\ProtectImport.png.ecrp lbcr.exe File opened for modification C:\Users\Admin\Pictures\ResetSearch.tiff lbcr.exe File renamed C:\Users\Admin\Pictures\ResetSearch.tiff => C:\Users\Admin\Pictures\ResetSearch.tiff.ecrp lbcr.exe File renamed C:\Users\Admin\Pictures\UndoBlock.png => C:\Users\Admin\Pictures\UndoBlock.png.ecrp lbcr.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation lbcr.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation lbcr.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation lbcr.exe -
Drops desktop.ini file(s) 10 IoCs
description ioc Process File created C:\Users\Admin\Desktop\desktop.ini lbcr.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini lbcr.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini lbcr.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini lbcr.exe File created C:\Users\Admin\Pictures\desktop.ini lbcr.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini lbcr.exe File created C:\Users\Admin\Downloads\desktop.ini lbcr.exe File created C:\Users\Admin\Pictures\desktop.ini lbcr.exe File created C:\Users\Admin\Desktop\desktop.ini lbcr.exe File created C:\Users\Admin\Downloads\desktop.ini lbcr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4860 set thread context of 4748 4860 lbcr.exe 79 PID 1740 set thread context of 424 1740 lbcr.exe 90 PID 4980 set thread context of 4760 4980 lbcr.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4820 schtasks.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell lbcr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open lbcr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\lbcr.exe %1" lbcr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\lbcr.exe %1" lbcr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp lbcr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open\command lbcr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2200 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe 424 lbcr.exe 4760 lbcr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 424 lbcr.exe Token: SeBackupPrivilege 2436 vssvc.exe Token: SeRestorePrivilege 2436 vssvc.exe Token: SeAuditPrivilege 2436 vssvc.exe Token: SeDebugPrivilege 4760 lbcr.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4860 wrote to memory of 4748 4860 lbcr.exe 79 PID 4748 wrote to memory of 3216 4748 lbcr.exe 82 PID 4748 wrote to memory of 3216 4748 lbcr.exe 82 PID 4748 wrote to memory of 3216 4748 lbcr.exe 82 PID 3216 wrote to memory of 4268 3216 cmd.exe 84 PID 3216 wrote to memory of 4268 3216 cmd.exe 84 PID 3216 wrote to memory of 4268 3216 cmd.exe 84 PID 3216 wrote to memory of 2200 3216 cmd.exe 85 PID 3216 wrote to memory of 2200 3216 cmd.exe 85 PID 3216 wrote to memory of 2200 3216 cmd.exe 85 PID 3216 wrote to memory of 4820 3216 cmd.exe 87 PID 3216 wrote to memory of 4820 3216 cmd.exe 87 PID 3216 wrote to memory of 4820 3216 cmd.exe 87 PID 3216 wrote to memory of 1740 3216 cmd.exe 88 PID 3216 wrote to memory of 1740 3216 cmd.exe 88 PID 3216 wrote to memory of 1740 3216 cmd.exe 88 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 1740 wrote to memory of 424 1740 lbcr.exe 90 PID 424 wrote to memory of 4496 424 lbcr.exe 94 PID 424 wrote to memory of 4496 424 lbcr.exe 94 PID 424 wrote to memory of 4496 424 lbcr.exe 94 PID 4496 wrote to memory of 3424 4496 cmd.exe 96 PID 4496 wrote to memory of 3424 4496 cmd.exe 96 PID 4496 wrote to memory of 3424 4496 cmd.exe 96 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4980 wrote to memory of 4760 4980 lbcr.exe 105 PID 4760 wrote to memory of 4064 4760 lbcr.exe 107 PID 4760 wrote to memory of 4064 4760 lbcr.exe 107 PID 4760 wrote to memory of 4064 4760 lbcr.exe 107 PID 4064 wrote to memory of 4388 4064 cmd.exe 109 PID 4064 wrote to memory of 4388 4064 cmd.exe 109 PID 4064 wrote to memory of 4388 4064 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\lbcr.exe"C:\Users\Admin\AppData\Local\Temp\lbcr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\lbcr.exe"C:\Users\Admin\AppData\Local\Temp\lbcr.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "lbcr" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\lbcr.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:4268
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:2200
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "lbcr" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:4820
-
-
C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"5⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet6⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:3424
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exeC:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:4388
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
609B
MD5d12b2202c8663de63120a7239216f4c9
SHA1f0263381d735e0d3a029378de06e6c49f386bb4f
SHA256a1523cbbb1efe7eaed779caf6077a067519945accb1ab61a4c39323fffea6e5d
SHA512942e728bb334cd3a7c634617c04cc2848124505a7a5b3f3081e5d46334e313b1f6fbf854e94d4f44dd51692c39cd19d239b15de3f0aa443ebd8d60db2868ab80
-
Filesize
347KB
MD5dafc8e7ccd381af36f19267a2a9b3f9b
SHA1742c9021f4f0fb264c32a59a66e3ac514b8e166b
SHA2563cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf
SHA51270779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e
-
Filesize
347KB
MD5dafc8e7ccd381af36f19267a2a9b3f9b
SHA1742c9021f4f0fb264c32a59a66e3ac514b8e166b
SHA2563cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf
SHA51270779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e
-
Filesize
347KB
MD5dafc8e7ccd381af36f19267a2a9b3f9b
SHA1742c9021f4f0fb264c32a59a66e3ac514b8e166b
SHA2563cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf
SHA51270779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e
-
Filesize
347KB
MD5dafc8e7ccd381af36f19267a2a9b3f9b
SHA1742c9021f4f0fb264c32a59a66e3ac514b8e166b
SHA2563cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf
SHA51270779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e
-
Filesize
347KB
MD5dafc8e7ccd381af36f19267a2a9b3f9b
SHA1742c9021f4f0fb264c32a59a66e3ac514b8e166b
SHA2563cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf
SHA51270779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e