Analysis
-
max time kernel
93s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 23:59
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
LB3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
LB3.exe
Resource
win11-20240508-en
windows11-21h2-x64
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
567371a071752719b9890da555dccb9a
-
SHA1
4e076a6c2a213f5efc197cdd9e08d8362c24f456
-
SHA256
169da58a5e57c6a68c1b9c07061b70e6c60d23f1708821a091d6f41907b0e9d7
-
SHA512
08081a7a8dbf3434088c9fc51506e078db95abf8cf4797a279f5145d6658c970be896b4adcb25e40d2ecc115e2b11e0d7a688fbd34be98a4d8e62f83cf361e8a
-
SSDEEP
3072:C6glyuxE4GsUPnliByocWepW5nVTbXaiMI9iyVD4cr:C6gDBGpvEByocWegn1Jlr4
Malware Config
Extracted
C:\tmVnvSyWm.README.txt
Signatures
-
Renames multiple (809) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
5FDC.tmppid Process 2336 5FDC.tmp -
Executes dropped EXE 1 IoCs
Processes:
5FDC.tmppid Process 2336 5FDC.tmp -
Loads dropped DLL 1 IoCs
Processes:
LB3.exepid Process 2432 LB3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini LB3.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\tmVnvSyWm.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\tmVnvSyWm.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
LB3.exe5FDC.tmppid Process 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2336 5FDC.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tmVnvSyWm LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tmVnvSyWm\ = "tmVnvSyWm" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm\DefaultIcon\ = "C:\\ProgramData\\tmVnvSyWm.ico" LB3.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
LB3.exepid Process 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe 2432 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
5FDC.tmppid Process 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp 2336 5FDC.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeDebugPrivilege 2432 LB3.exe Token: 36 2432 LB3.exe Token: SeImpersonatePrivilege 2432 LB3.exe Token: SeIncBasePriorityPrivilege 2432 LB3.exe Token: SeIncreaseQuotaPrivilege 2432 LB3.exe Token: 33 2432 LB3.exe Token: SeManageVolumePrivilege 2432 LB3.exe Token: SeProfSingleProcessPrivilege 2432 LB3.exe Token: SeRestorePrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSystemProfilePrivilege 2432 LB3.exe Token: SeTakeOwnershipPrivilege 2432 LB3.exe Token: SeShutdownPrivilege 2432 LB3.exe Token: SeDebugPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeBackupPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe Token: SeSecurityPrivilege 2432 LB3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
LB3.exe5FDC.tmpdescription pid Process procid_target PID 2432 wrote to memory of 2336 2432 LB3.exe 32 PID 2432 wrote to memory of 2336 2432 LB3.exe 32 PID 2432 wrote to memory of 2336 2432 LB3.exe 32 PID 2432 wrote to memory of 2336 2432 LB3.exe 32 PID 2432 wrote to memory of 2336 2432 LB3.exe 32 PID 2336 wrote to memory of 1220 2336 5FDC.tmp 33 PID 2336 wrote to memory of 1220 2336 5FDC.tmp 33 PID 2336 wrote to memory of 1220 2336 5FDC.tmp 33 PID 2336 wrote to memory of 1220 2336 5FDC.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\ProgramData\5FDC.tmp"C:\ProgramData\5FDC.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5FDC.tmp >> NUL3⤵PID:1220
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:1364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d41764f35f77476f84037d26f17ec950
SHA1fe8e6bd4c520285c347c10986a7a6d78d2248dc8
SHA256a578edb80fcb9d09c5668f315bcd14a965f8b6ea67d8c464474ec7f5e126bf0b
SHA51295af9255ecf0eb676d3726fd31d4d951a39740017cf19a47695292488eeceeeaae7d6f69049082173c9193f1dc93971d347053e22c93ae83d84585e88938966c
-
Filesize
146KB
MD57d5cf4f7553d3cfb34f9b89c5dc882e2
SHA1fd2dcf45b2e0488a9fe2d80574410cc8599d3035
SHA256f7cdb157517789d040c875f7f0a31ff6d498a79c9073496607d91ccf9d4aa55d
SHA5120e49d7cdd4109d08c217c84874fd2676cf5be747a54aeadabac2fd1512f260d67beddd39e43bfa682723807be361e5e891861dcaf9f20f7e385d239a6f089d28
-
Filesize
1016B
MD50b45fc3bb5ecfc4c26e03fac71d58901
SHA1a74cdcd027147a06dfb6bb09030ce630eacd2d77
SHA2569569d1f997217139e5c79398af8e20382201ae66d07f31a71635dc072febe122
SHA51274b244770db52bcf50db9aeb3102eb9ec9253f5adcff200bef8e1d9e49d8d5e7b2e1c333b5f92723502ecbb3b9922eb4f9fa404a65c988afae0ad56e0303fa5e
-
Filesize
129B
MD5d1864cd128b7c471054b1a8ce1c12d6f
SHA17aca51d3fbd26fadde9be1509e3131e839bc3ea9
SHA256e3287995b69045f0344ff663847ed81ebd81a1b69dee04c38345f3589188a138
SHA5122a8c748369c2fed83cd8b3a0caa23b15089999ae38aa758ca26d5acc772d4acd38983aeeb6cc32c6849257f6cb20345a7966f1c5cef04bb7ed754d09c010df2b
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf