Analysis
- max time kernel
146s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
21/03/2024, 14:05
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target LB3.exe
- Size 149KB
- Sample240321-recdwadb63
- SHA256 a779818597f3d64aac07f3db86bfa6019bf84069691e581f9f2d1b5a0c15daf0
- MD5 ac6a7885e55155b6025f45bf90d5af64
- SHA1 08d5edf13c34b78c68c6a01e1f2346baa9de5d54
- SHA512 1d13fb7f5808392883e9644b91d4423765f3ac063ade2d511c85302fb9c9ebe5d2819f908b2223bf20f49b3162879bef60f50980d70b7fc4f90d8c1b5be47e51
- SSDEEP 3072:S6glyuxE4GsUPnliByocWepBoOoWPuqMLWlYcaS:S6gDBGpvEByocWejotfqMClY0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\LPJKYjRBM.README.txt
-
lockbit
Ransom Note
- ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in mail or tox. Tox ID LockBitSupp: 0DF6BDFBF6459753325943FAE72DF57F396F226FE7B9C1645D98750AAB01DF3CAFF6C13CBD52 mail Support: [email protected] >>>> Your personal DECRYPTION ID: 419A343AEF3FCBF8BEFFCCC181D86AB6 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in mail or tox. Tox ID LockBitSupp: 0DF6BDFBF6459753325943FAE72DF57F396F226FE7B9C1645D98750AAB01DF3CAFF6C13CBD52 mail Support: [email protected]
Emails
URLs
-
https://twitter.com/hashtag/lockbit?f=live
-
https://tox.chat/download.html
Signatures
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Renames multiple (649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini LB3.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini LB3.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPqw5t7wbb4ifycyqt82ni0yi9c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPfon446g2a_4nfa8tacfvg303c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP6ekjhoez5p_20oi1w2tepd1wd.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\LPJKYjRBM.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\LPJKYjRBM.bmp" LB3.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon\ = "C:\\ProgramData\\LPJKYjRBM.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LPJKYjRBM\ = "LPJKYjRBM" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LPJKYjRBM LB3.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe 1612 LB3.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeDebugPrivilege 1612 LB3.exe Token: 36 1612 LB3.exe Token: SeImpersonatePrivilege 1612 LB3.exe Token: SeIncBasePriorityPrivilege 1612 LB3.exe Token: SeIncreaseQuotaPrivilege 1612 LB3.exe Token: 33 1612 LB3.exe Token: SeManageVolumePrivilege 1612 LB3.exe Token: SeProfSingleProcessPrivilege 1612 LB3.exe Token: SeRestorePrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSystemProfilePrivilege 1612 LB3.exe Token: SeTakeOwnershipPrivilege 1612 LB3.exe Token: SeShutdownPrivilege 1612 LB3.exe Token: SeDebugPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeBackupPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe Token: SeSecurityPrivilege 1612 LB3.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE 1996 ONENOTE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2224 1612 LB3.exe 112 PID 1612 wrote to memory of 2224 1612 LB3.exe 112 PID 4872 wrote to memory of 1996 4872 printfilterpipelinesvc.exe 115 PID 4872 wrote to memory of 1996 4872 printfilterpipelinesvc.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4540
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{CDC0409B-068A-45C6-A7A5-240F19747709}.xps" 1335550363142000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD
- Size 129B
- SHA256 a36a7b04913079c2b6ce5b639e822de1a92e6c20ca2b27d2a075920686b2e1b2
- MD5 15f4c5760908f31e8de106930a04f923
- SHA1 d5b42bb9850a87f346c6b924a36da0e1e2b71410
- SHA512 e6495bc9b653969ce68003b7515b17025358f5fb655494973eebb77aaab3708c360fa187832c1e2ce958393ccdeb7e6a916e1c454d455c0d4b6894e5992dcc1d
- MD5 SHA1 SHA512
- Path C:\LPJKYjRBM.README.txt
- Size 2KB
- SHA256 11f45aaccde86779137b228564011f12425b3db2a55545cfdbe179eb86173061
- MD5 c9b8f100d5c288bbc3f23da9d9a619bd
- SHA1 9618dfaed3ac35fb625246afccc0e47ef3ac3eaa
- SHA512 8adc68cb92c1076fb87dd6028b1507a99f32377524fd7ac2d153926f81fe1b3ada726d500209061c1a133bda248be81f9770cd1801d66fa8710bcc93b6d164ab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{8533FAE2-1E8E-4020-9B27-424D9C67266F}
- Size 4KB
- SHA256 429577eda84de0506bfd5d9d110cd8b8b0ee547576a3f436f41adc52191785f2
- MD5 7d333423a1d091fd7d3a44ddfe452a52
- SHA1 3d0be1ea7beb9944d51f16053dff14e7a716006a
- SHA512 43713ed86982afce3ce2eac19da68583878f066c0d378bc7d081d4dce1a923fdf17bd751d99a9f92513f5a2e5dc71c527b62352b73ffcdc3fc211724c4e4839b
- SSDEEP 6:RaZfjYyfB3h1RRXUnfUetVXctPFKRqYRujlw//0lweI/ogARujd:RaNjYyf9/UfUetVXAaq5Wf/dx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 510f2c27472a2a35ded1a4c01425bd10e462ec278bbcae400482ea0379bda0ad
- MD5 995dbe073d9b70bcb128f85dfe66ee10
- SHA1 11488ed192c80aae712c4a22ab509215dbaea3e0
- SHA512 8016c7bb507361fbc3a0247be9278e96c7262501facb81d732345995c3f8f30e7640ab90c7727288cf6ef229c39f60e00d85a1eadc41ac9e50c33bb7355b7808
- SSDEEP 12:RaNjYyfHj/Uvt6XAaq5W6/dSFZozEIxA/L:YNjYyfHYMXAKq1Aj
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\CCCCCCCCCCC
- Size 129B
- SHA256 96cc7663bd8f8f3d5e926a23a157967d97137a3005cf15c6ce5fb6f08229f1a5
- MD5 0bdc333ce3720a9946ab2e0c80d3012e
- SHA1 183afb6d77444bde789fbd71363d7ebb679c58ea
- SHA512 33c590c7134ef3963d62e5838bf55a411496d460e621dbc133957047674d8e9b0a3b066c17a231ee655a5c8b553cec7ff838787604f7f57b347dda47e204f5c8
- MD5 SHA1 SHA512