Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 23:59
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
LB3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
LB3.exe
Resource
win11-20240508-en
windows11-21h2-x64
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
567371a071752719b9890da555dccb9a
-
SHA1
4e076a6c2a213f5efc197cdd9e08d8362c24f456
-
SHA256
169da58a5e57c6a68c1b9c07061b70e6c60d23f1708821a091d6f41907b0e9d7
-
SHA512
08081a7a8dbf3434088c9fc51506e078db95abf8cf4797a279f5145d6658c970be896b4adcb25e40d2ecc115e2b11e0d7a688fbd34be98a4d8e62f83cf361e8a
-
SSDEEP
3072:C6glyuxE4GsUPnliByocWepW5nVTbXaiMI9iyVD4cr:C6gDBGpvEByocWegn1Jlr4
Malware Config
Extracted
C:\tmVnvSyWm.README.txt
Signatures
-
Renames multiple (612) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
804D.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 804D.tmp -
Deletes itself 1 IoCs
Processes:
804D.tmppid Process 1864 804D.tmp -
Executes dropped EXE 1 IoCs
Processes:
804D.tmppid Process 1864 804D.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini LB3.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP4hsbjpnsfm2szz7sumjm85y5.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPpv5mau8ytcq0o10rkjkbhrn2c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPzfuvcpd_lxa5v9sfu3huo0pvb.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\tmVnvSyWm.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\tmVnvSyWm.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
LB3.exe804D.tmppid Process 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 1864 804D.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm\DefaultIcon\ = "C:\\ProgramData\\tmVnvSyWm.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tmVnvSyWm LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tmVnvSyWm\ = "tmVnvSyWm" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tmVnvSyWm\DefaultIcon LB3.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 4228 ONENOTE.EXE 4228 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LB3.exepid Process 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe 4344 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
804D.tmppid Process 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp 1864 804D.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeDebugPrivilege 4344 LB3.exe Token: 36 4344 LB3.exe Token: SeImpersonatePrivilege 4344 LB3.exe Token: SeIncBasePriorityPrivilege 4344 LB3.exe Token: SeIncreaseQuotaPrivilege 4344 LB3.exe Token: 33 4344 LB3.exe Token: SeManageVolumePrivilege 4344 LB3.exe Token: SeProfSingleProcessPrivilege 4344 LB3.exe Token: SeRestorePrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSystemProfilePrivilege 4344 LB3.exe Token: SeTakeOwnershipPrivilege 4344 LB3.exe Token: SeShutdownPrivilege 4344 LB3.exe Token: SeDebugPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeBackupPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe Token: SeSecurityPrivilege 4344 LB3.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
ONENOTE.EXEpid Process 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE 4228 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exe804D.tmpdescription pid Process procid_target PID 4344 wrote to memory of 2032 4344 LB3.exe 83 PID 4344 wrote to memory of 2032 4344 LB3.exe 83 PID 4408 wrote to memory of 4228 4408 printfilterpipelinesvc.exe 86 PID 4408 wrote to memory of 4228 4408 printfilterpipelinesvc.exe 86 PID 4344 wrote to memory of 1864 4344 LB3.exe 87 PID 4344 wrote to memory of 1864 4344 LB3.exe 87 PID 4344 wrote to memory of 1864 4344 LB3.exe 87 PID 4344 wrote to memory of 1864 4344 LB3.exe 87 PID 1864 wrote to memory of 4924 1864 804D.tmp 88 PID 1864 wrote to memory of 4924 1864 804D.tmp 88 PID 1864 wrote to memory of 4924 1864 804D.tmp 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2032
-
-
C:\ProgramData\804D.tmp"C:\ProgramData\804D.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\804D.tmp >> NUL3⤵PID:4924
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1832
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9A0D8323-5883-4978-B9E3-742BF70A5CBF}.xps" 1336461122963000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD543cb914ab3d6d9b8438b2713dba394a2
SHA1a310b88d0da42bc83cdf3028152b99dd6fabb196
SHA2561a76aeaa551991534f66b0961146b903b836b85d92cd4afde23e76127120eefd
SHA512829a3074ccec55429ab1dd4ee3d68c55541aca7f12f679d81a88884578cb3309f70fe0147ee2a6782a5a432de40ab7996d66db5e374a8b47f996ea471c523752
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
12.9MB
MD5e5fb5a3ac946cdfa748dd8432bad5b72
SHA158418a9134b4af7302f104a7d99a59963d908183
SHA256ddb6aad28ad0d20981a4421659d1f08f772908c9b5e6c64ea707c38f8440bf46
SHA512529cbd1531bbcfea7cc4e42abe6f2ea5bb359f194892c24a2e2bdf4623cac3248189bfa955f490669b2f370c896ea958db89b1cd5c13eba56c2eea8026d6484c
-
Filesize
146KB
MD5df6136be5ec40767d2896bd58edacad8
SHA1f6594c9c4eeffa1b7f65a49d580a386fe208275e
SHA25677894bb2df648b90538c28a1bb2ebbfc7462672852ad993d63f54bd7c76164b5
SHA512e7e15daf1090508bbf6370a687b3a08f3d337f0beef440d48eb39380b9db546ea8ea95421f5e3dd1eb27ade01e5d34f7f265b1b63d5a8eafe26f5a8cc78dc347
-
Filesize
4KB
MD5a4958afa2b66448b8acaeeca31d99eb6
SHA1232e9fa68e7b3a0e62f48225ac042e58fad11e1c
SHA25600c0097c0c4eb73239cf29a0777ca6258e71924807da1795679184b5bb1278f5
SHA51288b95ce812b509e3649bbc7a84ebf4ec3d32075ba71f967452da6e691180d2bebede8127fdb910a32830cdb8184f8156f5e81721acb6cce6acb7a87274fa1e46
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
4KB
MD5222ddb27fe79373f2883a325d07720ee
SHA1eb8df05f4487c29c2cd37b6ed5304111b79415d5
SHA256e80ea26dd66451a2f3e076e2ab2dfa0b0d61e6f4f38e571ff4a0aa0d599666e9
SHA512d666e984724af5428ac2dfd7f4504cdc303486a23cd5648e4a3c941046872e702f1b3a39ba335a869cdd760417a2306af6d2ceb2deafd57ac00394401113b00f
-
Filesize
1016B
MD50b45fc3bb5ecfc4c26e03fac71d58901
SHA1a74cdcd027147a06dfb6bb09030ce630eacd2d77
SHA2569569d1f997217139e5c79398af8e20382201ae66d07f31a71635dc072febe122
SHA51274b244770db52bcf50db9aeb3102eb9ec9253f5adcff200bef8e1d9e49d8d5e7b2e1c333b5f92723502ecbb3b9922eb4f9fa404a65c988afae0ad56e0303fa5e
-
Filesize
129B
MD56a16a0c66b30cd8bcfc91c7907732a92
SHA1f1f85f4833ad963f38ba75b179d4f62d843f59e6
SHA256eb19d307870f96582db7cc6707bed449c570cb16364c2f02f039f2cab10b5cdb
SHA512387811e6828661d05838dae62f0adc4030a981a21aa50b0e6c3feed716a6de227a4787d684c2898507da26ed12270056668111f803fd776a7e1966de798297ba