Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 07:00
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
LB3.exe
-
Size
145KB
-
MD5
2a704c78d287be6fb1a9324dd3bbd780
-
SHA1
2f79d2d07b33be225d3d333477c2d2159a471e0e
-
SHA256
dec9845622a1996d768b0f38b7d7d16e6c76b2572b7e2eac55f678e686d4dc6f
-
SHA512
a2681bdb05ecb2636958b37a65c32bfd27467b241052133ad7f02bb634ad6e5539718ba810c3568f9cf3d10996cdd255e6632c75565ec40b278cff88713a812d
-
SSDEEP
3072:S6glyuxE4GsUPnliByocWepLk+B2Rq+V8Lmp:S6gDBGpvEByocWelKq8T
Malware Config
Signatures
-
Renames multiple (590) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7EE5.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 7EE5.tmp -
Deletes itself 1 IoCs
Processes:
7EE5.tmppid Process 808 7EE5.tmp -
Executes dropped EXE 1 IoCs
Processes:
7EE5.tmppid Process 808 7EE5.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini LB3.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPx6qsjpozifj6auq2xsm1ptx3d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPgq63lfpuyqh203rex_iagr_oc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPp0dj2jmdvlbfrtbpymflet7be.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\AjrMf9Fb5.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\AjrMf9Fb5.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
LB3.exe7EE5.tmppid Process 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 808 7EE5.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AjrMf9Fb5 LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AjrMf9Fb5\ = "AjrMf9Fb5" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AjrMf9Fb5\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AjrMf9Fb5 LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AjrMf9Fb5\DefaultIcon\ = "C:\\ProgramData\\AjrMf9Fb5.ico" LB3.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 3548 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 4444 ONENOTE.EXE 4444 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LB3.exepid Process 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe 2324 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
7EE5.tmppid Process 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp 808 7EE5.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeDebugPrivilege 2324 LB3.exe Token: 36 2324 LB3.exe Token: SeImpersonatePrivilege 2324 LB3.exe Token: SeIncBasePriorityPrivilege 2324 LB3.exe Token: SeIncreaseQuotaPrivilege 2324 LB3.exe Token: 33 2324 LB3.exe Token: SeManageVolumePrivilege 2324 LB3.exe Token: SeProfSingleProcessPrivilege 2324 LB3.exe Token: SeRestorePrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSystemProfilePrivilege 2324 LB3.exe Token: SeTakeOwnershipPrivilege 2324 LB3.exe Token: SeShutdownPrivilege 2324 LB3.exe Token: SeDebugPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeBackupPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe Token: SeSecurityPrivilege 2324 LB3.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
NOTEPAD.EXEONENOTE.EXEpid Process 3548 NOTEPAD.EXE 4444 ONENOTE.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
ONENOTE.EXEpid Process 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE 4444 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exe7EE5.tmpdescription pid Process procid_target PID 2324 wrote to memory of 1852 2324 LB3.exe 84 PID 2324 wrote to memory of 1852 2324 LB3.exe 84 PID 4516 wrote to memory of 4444 4516 printfilterpipelinesvc.exe 88 PID 4516 wrote to memory of 4444 4516 printfilterpipelinesvc.exe 88 PID 2324 wrote to memory of 808 2324 LB3.exe 89 PID 2324 wrote to memory of 808 2324 LB3.exe 89 PID 2324 wrote to memory of 808 2324 LB3.exe 89 PID 2324 wrote to memory of 808 2324 LB3.exe 89 PID 808 wrote to memory of 4308 808 7EE5.tmp 90 PID 808 wrote to memory of 4308 808 7EE5.tmp 90 PID 808 wrote to memory of 4308 808 7EE5.tmp 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1852
-
-
C:\ProgramData\7EE5.tmp"C:\ProgramData\7EE5.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7EE5.tmp >> NUL3⤵PID:4308
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:908
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\AjrMf9Fb5.README.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:3548
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{ABF1B251-5774-44A0-AA68-AFDEFD6892BA}.xps" 1336420445067300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD57abbf5b8b456ce9da76972a49d561c2f
SHA10e94ab4186fb68d70bbe33d8f4ec9c16f2ce7df8
SHA256caeb4e113f9d044ddded88598fea8c6ecac8c214dd5cf10c421e89f345a1ca68
SHA512a450b27e7764311caef334dee1ba34fcdf15045fab31e545a6149697d0ea333c58dcc2e047f1e4f3624d54058d70494661e1d68ebf534d4dca3f7f2a5411b972
-
Filesize
19B
MD57edb66f1ed51a03a8b381c2307756c3c
SHA160fbdfcefe96843c077b66f7df2f89cbb3bd0312
SHA2560fb417b326d101acbdbb29f1a10c8cfea19b6ce313c17f970ecbfd318c5015dd
SHA512f65dc6c8a1494c267b217f562a6c98fa4b8d7ee9a77127d4062a6fba5e26879b9a4adb5649b3777d26f95ba491f29cde343fc4353e9ef6c8648ed51332a87dff
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
13.1MB
MD512425c74efece685191fab9f5b44543a
SHA18a5b85d5f9ce8508d4cd2e710b51cdee1f214b45
SHA2560f81e552cab5574f0d26536e5d6bf2152d111a95413f76b859d687041b153521
SHA51221263cc8fe1294a01720fc2e24140dc21658dc9ebb123b3d743a83ececc75bf579f1152cf73d67041144245b0b1f812aeaa7d620285ab7c7d9205bad34ca4cf1
-
Filesize
145KB
MD532dad7843baa0861c0f7267c4af5d320
SHA101008f6facfd8ae818a1698fbc39bdc9b755083f
SHA256c68706acac67647327230fe75709370de69f9e8b6f90fc9c5a8c8e35aa8110cb
SHA512451e44691b30ebe042b3497b88ee598bf26e38b7076d2ee837feab0fd5c3ebc6e9736b8fb8e91a46bd2e723b5a8580cd4b82e0f2f697895006ce423f7aa9ebca
-
Filesize
4KB
MD509adbabfe488b5075fae3cfc0c7ffaa6
SHA16c4f3751f7df1080b4f0ddd5e9a0174635a835f7
SHA256f2ac15d708441d82bc71200bb2a09e09b73add7f8e9651a82b367b8c3cc6416e
SHA51209da458e6524fee60c7bdd277ce80c98540bbd14ee74dc9b8f91ed64e85fc4a2151fd3ccf62df3ba31386735fe33949b2525d2f613095cc22fc98a5ae74e5c5d
-
Filesize
4KB
MD56dba6dee738a78266b6d1d2f4e6a40ab
SHA16b954e6b33e317e83390cb0b869553a2a7b0ea38
SHA256ec755e88a2fecdf1a18f758cab4fefa5b167f5c7065eb044bda3bdad79cbedad
SHA5123471db8100eaba1469ca997e7f4ca23314f2ff16562ab79217de0db830b6869b7e24a877a7e90280ae2bd3b28e07c21bbfa6ab5d104010e1887a2432c731470e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
4KB
MD52862629fe9ffd9ff1255a39570475a90
SHA181061fea98104c95064897f260c070a72613eb35
SHA2564de5971fe125dccb929e654ed98512526d90eeb7b463ae4cf774b015df1dd595
SHA512c6e48c980696c3f2e0a30ae00d8aaf5d57de438b74a489b3f10335fb65e5dba7bbfcc8792a84780505f4ed049847658c3f738768e723d0969307663412a28036
-
Filesize
129B
MD50e440eb06eb4ba65d9245e76c7dfa3af
SHA10989610dd604a1da1f74e246bc1036178901cd73
SHA256dc0acec169625142f297b998276d7bf4ed8b0039d6431c69b8b05ebf732f53d4
SHA512ada226ce359c98c82fb2893b2f8e6a77a0bb992998aa6b6527ab20504873464a3dc079b842a200acbfbc1eaf88d55ed14ea993f398834218e50419411c141810