Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 09:10
Behavioral task
behavioral1
Sample
lb4_svchost.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
lb4_svchost.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
15 signatures
300 seconds
General
-
Target
lb4_svchost.exe
-
Size
145KB
-
MD5
0e7adc219b82b823214edc523797b83e
-
SHA1
eb40b252523621aea48448efc0bf6b971cc906e7
-
SHA256
5a3cc12e20a0ecc79f526cd28344d24f48ff4f6da89235293edd264f02f69404
-
SHA512
44ab6ea43112e2c361c1303a4fb5e6edb9e0390c9c571ae0c8d7a87cb0a472d9fc2f034c98235db2676019bf025e09d5bfa7e783cfa4de5225be7acc9e51ba97
-
SSDEEP
1536:izICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD5bwnHm/1BviIdU/IqbNLu75RjJ:hqJogYkcSNm9V7D50nH2viI2xadRj1T
Score
9/10
Malware Config
Signatures
-
Renames multiple (8243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2300 8066.tmp -
Executes dropped EXE 1 IoCs
pid Process 2300 8066.tmp -
Loads dropped DLL 1 IoCs
pid Process 3040 lb4_svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini lb4_svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini lb4_svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2300 8066.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATWIZ.POC lb4_svchost.exe File opened for modification C:\Program Files\ImportConvertFrom.bmp lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\LICENSE lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jni.h.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.GIF lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageBlank.gif lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG.GO4nojG0Y lb4_svchost.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\GO4nojG0Y.README.txt lb4_svchost.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0098497.WMF lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF lb4_svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF lb4_svchost.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\GO4nojG0Y.README.txt lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png lb4_svchost.exe File opened for modification C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nome.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_decreaseindent.gif.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\DATES.XML.GO4nojG0Y lb4_svchost.exe File created C:\Program Files (x86)\MSBuild\GO4nojG0Y.README.txt lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImages.jpg.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow.css lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Sign.xsn lb4_svchost.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\GO4nojG0Y.README.txt lb4_svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png lb4_svchost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\settings.js lb4_svchost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\en-US\Sidebar.exe.mui lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MAIN.XML.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL98.POC.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\macroprogress.gif lb4_svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png lb4_svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\net.properties.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14845_.GIF lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105282.WMF.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF lb4_svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SPANISH.LNG lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ADD.GIF.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PAPERS.INI.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv lb4_svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296279.WMF.GO4nojG0Y lb4_svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBOB6.CHM.GO4nojG0Y lb4_svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe 3040 lb4_svchost.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp 2300 8066.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeDebugPrivilege 3040 lb4_svchost.exe Token: 36 3040 lb4_svchost.exe Token: SeImpersonatePrivilege 3040 lb4_svchost.exe Token: SeIncBasePriorityPrivilege 3040 lb4_svchost.exe Token: SeIncreaseQuotaPrivilege 3040 lb4_svchost.exe Token: 33 3040 lb4_svchost.exe Token: SeManageVolumePrivilege 3040 lb4_svchost.exe Token: SeProfSingleProcessPrivilege 3040 lb4_svchost.exe Token: SeRestorePrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSystemProfilePrivilege 3040 lb4_svchost.exe Token: SeTakeOwnershipPrivilege 3040 lb4_svchost.exe Token: SeShutdownPrivilege 3040 lb4_svchost.exe Token: SeDebugPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeBackupPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe Token: SeSecurityPrivilege 3040 lb4_svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2300 3040 lb4_svchost.exe 30 PID 3040 wrote to memory of 2300 3040 lb4_svchost.exe 30 PID 3040 wrote to memory of 2300 3040 lb4_svchost.exe 30 PID 3040 wrote to memory of 2300 3040 lb4_svchost.exe 30 PID 3040 wrote to memory of 2300 3040 lb4_svchost.exe 30 PID 2300 wrote to memory of 2040 2300 8066.tmp 31 PID 2300 wrote to memory of 2040 2300 8066.tmp 31 PID 2300 wrote to memory of 2040 2300 8066.tmp 31 PID 2300 wrote to memory of 2040 2300 8066.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\lb4_svchost.exe"C:\Users\Admin\AppData\Local\Temp\lb4_svchost.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\ProgramData\8066.tmp"C:\ProgramData\8066.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8066.tmp >> NUL3⤵PID:2040
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD50fcf7d2c276749acd46f862b19a6791a
SHA1d3f33bde74bec069fc9ef60c1f636ed448f9c97c
SHA256dec22f3c41a0c0ab8c599c3cb2bf071473802626aa8bf1e928720e3242d5fb5a
SHA5127258f533c07686519d1ef7a08e60a630d4b26426638e7f6f8d2061145ead45401a0f96c3535d7dd887a6c38847d8e1f78730ef99f0f67d8d5f26d054c9a75d73
-
Filesize
469B
MD5a995b39840afec2c6eee9c9be6f613c0
SHA1ebd213d1dd59c6efd723262cf3dfcbe62e1156f7
SHA256e61fb152f1a9290c4814feadc8723879f7aec2cbd20d40d83095eff85451acc7
SHA51201bf59aff64981911db25f307639b2b10b9a84b817df212c0a57ba9f9d987ecdfa4aaf7cd807948cd1f3756620535e1e212905c363b238023f80aa4f173adb33
-
Filesize
145KB
MD55c163c2c5194b1e6244c63e664570f5c
SHA1f2d6bd0c5efed35ec8ff0b47a729083e5afd4576
SHA256e85c72d1a3a7e6265e86b61f20a149b3a66341b8a1bbdd7d3601c31f6efc7300
SHA5125dbb43077033113de5d24305878a4627b2071df32276b801db83341ddc3eb41653f67a3a94db94d8150e8b39ba5a3352be32991c01affeeb10043e182a5b576a
-
Filesize
129B
MD52fe48687074d64b049341a907bfe6e3c
SHA1d3274bbc964bb3923fb695e0ac74bb5293e12d87
SHA256650daeb4af284e4c5a73898b2df1e04f484343d4363125095e8faedefe81fa83
SHA512f9a08d6eb7e75c89c63434ae48eabb068eed5d36ddb58e3143ac5465e9675fbff79cff82dfdfe13b0baf1c53ed760d3ee7c3ac775d1679519bf5b853fd38e962
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf