Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 03:54
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
- Target LB3.exe
- Size 146KB
- Sample240604-ef7vysch52
- SHA256 d82aa76842e45325dd2b665ae410f91dfeb8fd2f9bc6449630090f3bac0c95b0
- MD5 0f9efaba9a13338ad97e0e6ef2aabd6d
- SHA1 97db912c8f0055152837e424cd8764f905a29930
- SHA512 c8ab75ae0046c1c33f1141d1d85aeae9eaf4952f8cc9bb6993c0d29bd8f67c7a1430339020b4652ee399899f1c993c34feeeef54bfd0c37fa56825437f85149a
- SSDEEP 3072:g6glyuxE4GsUPnliByocWepRdJxGkpV4wTwAY:g6gDBGpvEByocWedG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation D50F.tmp - Deletes itself 1 IoCs
pid Process 5092 D50F.tmp - Executes dropped EXE 1 IoCs
pid Process 5092 D50F.tmp - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini LB3.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP75xngpcpfnpaizo42j4gu9tab.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPjybfx85t7wkm1u3c6jva4exvb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPac92r0wlkuyzbicdk9e31zndb.TMP printfilterpipelinesvc.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 5092 D50F.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hokwnrPwS LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hokwnrPwS\DefaultIcon\ = "C:\\ProgramData\\hokwnrPwS.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hokwnrPwS LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hokwnrPwS\ = "hokwnrPwS" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hokwnrPwS\DefaultIcon LB3.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe 4400 LB3.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp 5092 D50F.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeDebugPrivilege 4400 LB3.exe Token: 36 4400 LB3.exe Token: SeImpersonatePrivilege 4400 LB3.exe Token: SeIncBasePriorityPrivilege 4400 LB3.exe Token: SeIncreaseQuotaPrivilege 4400 LB3.exe Token: 33 4400 LB3.exe Token: SeManageVolumePrivilege 4400 LB3.exe Token: SeProfSingleProcessPrivilege 4400 LB3.exe Token: SeRestorePrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSystemProfilePrivilege 4400 LB3.exe Token: SeTakeOwnershipPrivilege 4400 LB3.exe Token: SeShutdownPrivilege 4400 LB3.exe Token: SeDebugPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeBackupPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe Token: SeSecurityPrivilege 4400 LB3.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE 1372 ONENOTE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4400 wrote to memory of 1772 4400 LB3.exe 103 PID 4400 wrote to memory of 1772 4400 LB3.exe 103 PID 4400 wrote to memory of 5092 4400 LB3.exe 106 PID 4400 wrote to memory of 5092 4400 LB3.exe 106 PID 4400 wrote to memory of 5092 4400 LB3.exe 106 PID 4400 wrote to memory of 5092 4400 LB3.exe 106 PID 1196 wrote to memory of 1372 1196 printfilterpipelinesvc.exe 107 PID 1196 wrote to memory of 1372 1196 printfilterpipelinesvc.exe 107 PID 5092 wrote to memory of 1904 5092 D50F.tmp 110 PID 5092 wrote to memory of 1904 5092 D50F.tmp 110 PID 5092 wrote to memory of 1904 5092 D50F.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1772
-
-
C:\ProgramData\D50F.tmp"C:\ProgramData\D50F.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D50F.tmp >> NUL3⤵PID:1904
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:4860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2376
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1CA84C72-C46A-44AB-ADA7-EB15DC019314}.xps" 1336194691322600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\BBBBBBBBBBB
- Size 129B
- SHA256 d2ad13092035ed6c225e0c687abba0d3a0620c27e34c09ce8e24fdcbfe9e5267
- MD5 c11d62c631f6f291f1d03a6365208d5c
- SHA1 4bb804994b448c3c8dc439944b6752b95b1e7249
- SHA512 61c86b8f677f39ca2c6860a887a3df2bdb0578a5d297cb2a16ed288f884115ff45f8a3e67d60d46b24857c57bbc685a5a55f325d18fb702f5cbc295646f12ba7
- MD5 SHA1 SHA512
- Path C:\ProgramData\D50F.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CCCCCCC
- Size 146KB
- SHA256 4cd616779cea65fe7527d21e14062d7f6593542b9b6158fb8c48b3df24a7fe0b
- MD5 ca85e10842c3570c9dbc920e664cd6d3
- SHA1 b89dc7bf88b749a8d7555d2855db7954ddec727d
- SHA512 ea3d28337c5586d7e18f1031c71c81c47be5795756bcdb6c2524ce12687e98c8108108d24fe05309ded5d2b5e0524fdcc00337ebc0c3ca683c88b048811ba5c5
- SSDEEP 3072:qkYUsb6FfOHJoOO9TDJHBz8A5kYUsb6FfOHJoOO9TDJHBz8A5kYUsb6k:qkobsfOHJoOO9ZH9r5kobsfOHJoOO9ZP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{63B8E055-C81E-4190-ADA7-24DB3824441D}
- Size 4KB
- SHA256 b84d570e2ac1970a630ef05526fb51df84081ce26d9ef58092c983602c51aee7
- MD5 1dde685c4bc2a96c4177be76ef60f98f
- SHA1 d8a28020e7200e2769aff13745cd99456a3f907d
- SHA512 3205144b2588e7a63d3adcc3a124a883d84317b8006d410481034249f293980a549aff6364c078e3f0da0999724a24348779d8c6cbe814fb713be59b85187280
- SSDEEP 6:RaZfjYyfB3h1RRXUnfU2mhSudqiHFKyb1STthczSTtlrRujlw//0lweI/4s6STtS:RaNjYyf9/UfU24qTthBtlUWf/jtl8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 9ff0f2e1472c5254c0cde7f93faf32d445e6a4e18a314195d5b9bf940854953d
- MD5 58e55d983466fb1ae41caa7356b14188
- SHA1 c6e54b156cb7242dc2376b27061c873c8e95d0c5
- SHA512 de957cf8d23f4a568beac07b9f20a8b4ce2e3acf6251461f77cd19f56278cce1d9f80f07ecf8a8dbd211204c90a503e052d2e7322a14a13b0c46923f5e569d38
- SSDEEP 12:RaNjYyfHj/Uv1LsqTthBtlUW6/jt1hrtlNWb/vDpEIxA/L:YNjYyfHYJbhL+vDZSb/Lp1Aj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\hokwnrPwS.README.txt
- Size 865B
- SHA256 36b49a373e27694fa1be03e9557ef503c0e436289de49ff59718f19c4131f4ea
- MD5 80ce254bf1170938cb7d41f5a98bf0ad
- SHA1 f8eb2e6395f16c206d32d5fefccd4f7419324bc9
- SHA512 d1f065109ef0aaa0a57a58bc2018e5042bda9883e584520943c4a8ef0b3d424d88eba0f69b6d29fb92a52837d388f0ec31136d3c79f07469eaaa811976db86f7
- MD5 SHA1 SHA512
- Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD
- Size 129B
- SHA256 255d873e043bd25544e071305c841bbd0c53c7bf5eb3a8507e780833ab8e4f26
- MD5 f3cc8dad60e2d2fec057bdf421bd6742
- SHA1 a8355b81f4d679a2da93c493ec46b75a5a92ea4a
- SHA512 4c535fb982df9f85865ed07ca82a75ffd3dbe5c48c00b470f1d01c4dcba970bd476200f13c43cbf32565630781de22cfc3c842dd74049dae906a4a50539f0170
- MD5 SHA1 SHA512