Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 04:11
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
General
-
Target
LB3.exe
-
Size
145KB
-
MD5
f24e4d221c73ebf1c2fb12d15c13fde9
-
SHA1
019ef3cbd70a0c4e3ea5c45ec4afdc28a655ed81
-
SHA256
4f006379bbd3a2b2611346595ce373595031177d7043200591d81150aefc8ee0
-
SHA512
1508ebf2cba481eda06707d133b994932688d6d3be6c1373e9e88bf8c36a02331df31dc1a575b6e4ed8a160294c88ae8767115af16af94e51b1589bdeedd1629
-
SSDEEP
3072:H6glyuxE4GsUPnliByocWepMIO/oULmUHI:H6gDBGpvEByocWeGy6
Malware Config
Signatures
-
Renames multiple (321) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2180 F289.tmp -
Executes dropped EXE 1 IoCs
pid Process 2180 F289.tmp -
Loads dropped DLL 1 IoCs
pid Process 2396 LB3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini LB3.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\N0IKX538u.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\N0IKX538u.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2180 F289.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Control Panel\Desktop LB3.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.N0IKX538u LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.N0IKX538u\ = "N0IKX538u" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\N0IKX538u\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\N0IKX538u LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\N0IKX538u\DefaultIcon\ = "C:\\ProgramData\\N0IKX538u.ico" LB3.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe 2396 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp 2180 F289.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeDebugPrivilege 2396 LB3.exe Token: 36 2396 LB3.exe Token: SeImpersonatePrivilege 2396 LB3.exe Token: SeIncBasePriorityPrivilege 2396 LB3.exe Token: SeIncreaseQuotaPrivilege 2396 LB3.exe Token: 33 2396 LB3.exe Token: SeManageVolumePrivilege 2396 LB3.exe Token: SeProfSingleProcessPrivilege 2396 LB3.exe Token: SeRestorePrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSystemProfilePrivilege 2396 LB3.exe Token: SeTakeOwnershipPrivilege 2396 LB3.exe Token: SeShutdownPrivilege 2396 LB3.exe Token: SeDebugPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeBackupPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe Token: SeSecurityPrivilege 2396 LB3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2180 2396 LB3.exe 33 PID 2396 wrote to memory of 2180 2396 LB3.exe 33 PID 2396 wrote to memory of 2180 2396 LB3.exe 33 PID 2396 wrote to memory of 2180 2396 LB3.exe 33 PID 2396 wrote to memory of 2180 2396 LB3.exe 33 PID 2180 wrote to memory of 1768 2180 F289.tmp 34 PID 2180 wrote to memory of 1768 2180 F289.tmp 34 PID 2180 wrote to memory of 1768 2180 F289.tmp 34 PID 2180 wrote to memory of 1768 2180 F289.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\ProgramData\F289.tmp"C:\ProgramData\F289.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F289.tmp >> NUL3⤵PID:1768
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a8a886abdf8816fcc5b07c6044fe7813
SHA19265c1b315323c2b920fc14ff36900760f9309bd
SHA2566d82d71eac64803cf06eb960311e649a96ed2e1f75bb5423c72ff17241aa9c08
SHA51268c53d6e716e2979ec8bfddcdfcdadde797a81be004c080246b4ae3f9428c36db7fdab1dacada2a5efc99f9dbb812a109839353d56ad2940a4c8de8818603ee8
-
Filesize
19B
MD57edb66f1ed51a03a8b381c2307756c3c
SHA160fbdfcefe96843c077b66f7df2f89cbb3bd0312
SHA2560fb417b326d101acbdbb29f1a10c8cfea19b6ce313c17f970ecbfd318c5015dd
SHA512f65dc6c8a1494c267b217f562a6c98fa4b8d7ee9a77127d4062a6fba5e26879b9a4adb5649b3777d26f95ba491f29cde343fc4353e9ef6c8648ed51332a87dff
-
Filesize
145KB
MD55988c2acfe2794f8a3ffe1b3b3d2f044
SHA13a10fe2c68e156f8e5c2681e094b2c19cc0be883
SHA2565d6deabbba1b947f96add8f8ea60fdf6c3f841c96754bca7e62e7d4d51cae3c6
SHA512fadc09a81cf00caa2882a319efe06cb1dc70f55ee37847ba603c24d4be70c8062f18e27c3bfd11b7e396a53ed32df36de0cf8e588933f728ef31e9535c584671
-
Filesize
129B
MD5aef182bb49881afefdea21ca8a3a7734
SHA153f31f0cf9c8ace46bf0a0ee11ce59f4868b8e0f
SHA2567f396d7e729d35e6c20de924b638f2634f539c2c32e57d46d97ab9efc9e7cad4
SHA512e9fd4c2ab1b49c4ba039ddc02c4d43fef7497f4262802d2e1d888f8f89c4c7c272ce42cce1780fe42061e6baae375348236d59a50802cc676d905a70c4717d28
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf