Resubmissions
30/04/2024, 19:54
240430-ymx4waeg8z1030/04/2024, 19:45
240430-yglhwseg2x1030/04/2024, 19:30
240430-x8a1ssee5v1030/04/2024, 15:30
240430-sxxcfaaa4110Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
30/04/2024, 15:30
Behavioral task
behavioral1
Sample
lb.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
lb.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
lbb.exe
Resource
win7-20240215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
lbb.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target lb.exe
- Size 194KB
- Sample240430-sxxcfaaa41
- SHA256 41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
- MD5 6fd558cf3add096970e15d1e62ca1957
- SHA1 78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23
- SHA512 fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc
- SSDEEP 3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 2224 2646.tmp - Executes dropped EXE 1 IoCs
pid Process 2224 2646.tmp - Loads dropped DLL 1 IoCs
pid Process 2972 lb.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini lb.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini lb.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\AAtvmKv4L.bmp" lb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\AAtvmKv4L.bmp" lb.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2224 2646.tmp - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallpaperStyle = "10" lb.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop lb.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AAtvmKv4L lb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AAtvmKv4L\ = "AAtvmKv4L" lb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L\DefaultIcon lb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L lb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L\DefaultIcon\ = "C:\\ProgramData\\AAtvmKv4L.ico" lb.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe 2972 lb.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp 2224 2646.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeDebugPrivilege 2972 lb.exe Token: 36 2972 lb.exe Token: SeImpersonatePrivilege 2972 lb.exe Token: SeIncBasePriorityPrivilege 2972 lb.exe Token: SeIncreaseQuotaPrivilege 2972 lb.exe Token: 33 2972 lb.exe Token: SeManageVolumePrivilege 2972 lb.exe Token: SeProfSingleProcessPrivilege 2972 lb.exe Token: SeRestorePrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSystemProfilePrivilege 2972 lb.exe Token: SeTakeOwnershipPrivilege 2972 lb.exe Token: SeShutdownPrivilege 2972 lb.exe Token: SeDebugPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeBackupPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe Token: SeSecurityPrivilege 2972 lb.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2224 2972 lb.exe 30 PID 2972 wrote to memory of 2224 2972 lb.exe 30 PID 2972 wrote to memory of 2224 2972 lb.exe 30 PID 2972 wrote to memory of 2224 2972 lb.exe 30 PID 2972 wrote to memory of 2224 2972 lb.exe 30 PID 2224 wrote to memory of 588 2224 2646.tmp 31 PID 2224 wrote to memory of 588 2224 2646.tmp 31 PID 2224 wrote to memory of 588 2224 2646.tmp 31 PID 2224 wrote to memory of 588 2224 2646.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\lb.exe"C:\Users\Admin\AppData\Local\Temp\lb.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\ProgramData\2646.tmp"C:\ProgramData\2646.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2646.tmp >> NUL3⤵PID:588
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini
- Size 129B
- SHA256 318e816a8a222077de4794e4a53413cca1f1187984c8c03a40dd836aef405cab
- MD5 1c43eba9427fee1158b957ce2c050dea
- SHA1 431c22dadf2c048954e1059fab7613fbfacd9e53
- SHA512 274b0e695ebf4274b3d11f3edf7636ce68474495ff74b1879471134b53e5c7197edcfffb1bda3acee174ea445a8593d21319119b2f87db4aba6d519adfe4625d
- MD5 SHA1 SHA512
- Path C:\AAtvmKv4L.README.txt
- Size 434B
- SHA256 192d1e6078570865531e8a4c9840a483c4a2ac35fe468107284991f6da813191
- MD5 b4709a56b9d7f431da172316cda720be
- SHA1 d2132f7129a7003ec4c0392f0f08cd24ea353da6
- SHA512 e390d51e95db5e56c666a2895dc87dab41d97e7ce3c0df1f2466abf14a651167232521ab5f52746d16bab0ef14e6c0ee9dcfe29894604d695b0d064909378227
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDD
- Size 194KB
- SHA256 37b28bcc8122f4aa50b256316c8236bf83b02f3477e30181a61d9a944b343083
- MD5 2e20a699ba02af71f7e20bab176f7dd1
- SHA1 11aace6baa4e775fff0681a16dca2b1138d97a02
- SHA512 0fbcdb5ef19f8038ce66b02a119172f4c23fd2bd29c5e0617aabadd85946b7ecfb9abce2bd409bac58a0337ef054b5ce6d37d3613c75dba28d3b47cebe0db5dd
- SSDEEP 6144:m/4e4ZDJJtxp/4e4ZDJJtxp/4e4ZDJJtxA:oKH1KH1KHA
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\EEEEEEEEEEE
- Size 129B
- SHA256 349e2d89f0336e5bc3ad967399a386b20493cebc7c760e45883f1a532c085a60
- MD5 58c28d5932c1851088d4ecc832cdd25a
- SHA1 de4ff2806484f693a1d6eec9d7ee7458a6cfb6b7
- SHA512 3167e697d5a4f87d5fed4ed86ef449525e753b081d98ea8b1e63ea21f6afe8731a391082e705d4b1d78af308dc1094039206e8688e58d7e02951530a804dee65
- MD5 SHA1 SHA512
- Path \ProgramData\2646.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP