Resubmissions
14-07-2024 13:00
240714-p8n9es1elq 1014-07-2024 13:00
240714-p8metstdra 1018-06-2024 22:58
240618-2xvnaasglk 10Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-06-2024 22:58
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win11-20240611-en
windows11-21h2-x64
19 signatures
150 seconds
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
2357ecbcf3b566c76c839daf7ecf2681
-
SHA1
89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58
-
SHA256
0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305
-
SHA512
bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU
Score
10/10
Malware Config
Extracted
Path
C:\7V7uPExzv.README.txt
Ransom Note
~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~
>>>> Your data is encrypted... but dont freak out
If we encrypted you, you majorly fucked up. But... all can be saved
But not for free, we require an xmr payment
>>>> What guarantees that we will not deceive you?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption.
Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right?
If we do not give you decrypter then nobody will pay us in the future.
To us, our reputation is very important. There is no dissatisfied victim after payment.
>>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID
Download and install TOR Browser https://www.torproject.org/
Write to a chat and wait for the answer, we will always answer you.
Sometimes you will need to wait a while
Links for Tor Browser:
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
Link for the normal browser
http://group.goocasino.org
https://nullbulge.com
>>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3C778AC2B58055561F
>>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
http://group.goocasino.org
https://nullbulge.com
Signatures
-
Renames multiple (567) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
6AD1.tmppid Process 404 6AD1.tmp -
Executes dropped EXE 1 IoCs
Processes:
6AD1.tmppid Process 404 6AD1.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2198854727-3842442895-2838824242-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2198854727-3842442895-2838824242-1000\desktop.ini LB3.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPmx_55a9mve6kuibtiea16mk0d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPd7mhm92_zvjw6lvvc0pk5_bkb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPbn7fbkmwdg3c9vxo9njz1ejkc.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
LB3.exe6AD1.tmppid Process 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 404 6AD1.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2198854727-3842442895-2838824242-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon LB3.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 3020 ONENOTE.EXE 3020 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LB3.exepid Process 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe 1688 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
6AD1.tmppid Process 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp 404 6AD1.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeDebugPrivilege 1688 LB3.exe Token: 36 1688 LB3.exe Token: SeImpersonatePrivilege 1688 LB3.exe Token: SeIncBasePriorityPrivilege 1688 LB3.exe Token: SeIncreaseQuotaPrivilege 1688 LB3.exe Token: 33 1688 LB3.exe Token: SeManageVolumePrivilege 1688 LB3.exe Token: SeProfSingleProcessPrivilege 1688 LB3.exe Token: SeRestorePrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSystemProfilePrivilege 1688 LB3.exe Token: SeTakeOwnershipPrivilege 1688 LB3.exe Token: SeShutdownPrivilege 1688 LB3.exe Token: SeDebugPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeBackupPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe Token: SeSecurityPrivilege 1688 LB3.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
ONENOTE.EXEpid Process 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE 3020 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exe6AD1.tmpdescription pid Process procid_target PID 1688 wrote to memory of 1884 1688 LB3.exe 83 PID 1688 wrote to memory of 1884 1688 LB3.exe 83 PID 2824 wrote to memory of 3020 2824 printfilterpipelinesvc.exe 86 PID 2824 wrote to memory of 3020 2824 printfilterpipelinesvc.exe 86 PID 1688 wrote to memory of 404 1688 LB3.exe 87 PID 1688 wrote to memory of 404 1688 LB3.exe 87 PID 1688 wrote to memory of 404 1688 LB3.exe 87 PID 1688 wrote to memory of 404 1688 LB3.exe 87 PID 404 wrote to memory of 1384 404 6AD1.tmp 88 PID 404 wrote to memory of 1384 404 6AD1.tmp 88 PID 404 wrote to memory of 1384 404 6AD1.tmp 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1884
-
-
C:\ProgramData\6AD1.tmp"C:\ProgramData\6AD1.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6AD1.tmp >> NUL3⤵PID:1384
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1288
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C4E3CDC9-A946-4C0C-AADE-773C07D28FC7}.xps" 1336322510355800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5220aabb8067cbc9329368991c195461e
SHA1e22348028dee74d2156c40645d7905cd1c4229c7
SHA256d4286da6838c5278f41abc23062ae40bddcc7cb0033b12d8ae27cea528bcdbb8
SHA512acbc8527769c5762890e96509c07fe561dac9ed3f50584e84683c0a5b12e6033b7206f95b24e9efa48ed38a686c7b0289dd056ba5f7ab5020d3eac3def0783ea
-
Filesize
1KB
MD5bac4db7f53b538805e2d8dc023e0b172
SHA1a6ec65edfcdd1ada16731ad60b4acfa84111a0fb
SHA2566df7ed8a6b66f5fdaada589a99ea0fe354ca5469a9bd7d903cdfe3eba2ca353e
SHA51274cb9786f63cfe2610c9e107eaca03d5496d9097899aea0d1b30e1ae66e07e11485c5c76d8b81c7b8245d680a178c04130d3663f7973c2153a1d4dcc8c25df1f
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD591cccb0c66a21c6bf01a9e6fe5a00428
SHA1519f1ea084990f32f41606a25bdb52ca0755a2f4
SHA256027a89fdd9dc18a4ac7eb8461c8f3be7911900a7eb2ab768125f91dfac5105ca
SHA512b443f7f944786590e8386fbc9c750f9d7f79464968bf95c9620382fcdfc23b88a09b36a5c94090e87f055b12c95fad7326726113af5a7b115518b2f99138aac5
-
Filesize
4KB
MD529ab8716815ad7490e35b4fd70a1a1c6
SHA18d6f62a5879ef854c0188ee57fb8b2f93d1aac1c
SHA25606686c38d1cef4d7ca7c08d3a244f6448247bba953bd6ac0e365d857641ab945
SHA5120321bdd954df8e086230736bd3e60032a0e30760dfe8673ffdb1188540611379c59d08f73c95ef8bfdf382ae3cdccb2bef799c36d2899a57b3db09f2d530fde5
-
Filesize
129B
MD57b92092bcc1be93e892588cee3555f26
SHA16af8e32708451d2990aca8a7086cf0ed48c4d98e
SHA2563786ffdd440a7b70643651a0e8cc87f9199d56831356b58d582ac09144d7fcc5
SHA51291941e1690c4520119dd701e2ef3aee77e52b0222bac8350e2030366d215e038de61560772def33a4b99e0a5e0ea42fcbaf591941cfe1693d04004fd47825dbc