Overview

overview

10

Static

static

10

04df8dd30d...a8.exe

windows7-x64

10

04df8dd30d...a8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    04df8dd30da8b5853f48cc1ac9b695a8
  • Size 6.1MB
  • Sample231225-ex7lhsfcdp
  • SHA256 78f4dd4b0e0bff6009f56a8b97332f600cec39e3c1d0e1cac6c7ee47a4bb9201
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
legionlockerdiscoveryevasionexploitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\LegionReadMe.txt

Ransom Note
  • Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor. Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $50. How do i pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom of the sheet. Contact: 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us ([email protected]) In case of no anwser in 72 hours write us to this email: [email protected] What if i already paid? Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software, it may cause pernament data loss. Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
Wallets

  • 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

URLs

  • http://mail2tor2zyjdctd.onion/

Targets

    • Target
      04df8dd30da8b5853f48cc1ac9b695a8
    • Size 6.1MB
    • SHA256 78f4dd4b0e0bff6009f56a8b97332f600cec39e3c1d0e1cac6c7ee47a4bb9201
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionexploitpersistenceransomwarespywarestealer

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (191) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks