Analysis
-
max time kernel
98s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 16:04
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
LB3.exe
-
Size
145KB
-
MD5
6ef47bf0769d5ffff66803b62a6ef2c3
-
SHA1
e3825327205f8f39c42c1b0d76c8f0aeff587dec
-
SHA256
970c78e5f252490ea381faf4e9b311764b8be5f1f97f737fc96a8357018fd552
-
SHA512
30cb1a3c86158f48a469f5ec1cad8584a9f432bf1c3f020321982180cd60f9acb2b17abcaff9a801d417548d5a482f746d602a8b267cd8c7a098d625e3a2571a
-
SSDEEP
3072:pqJogYkcSNm9V7D8B+L5PDVdsvHuMXva4T:pq2kc4m9tD8B+LTe1y
Malware Config
Signatures
-
Renames multiple (627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D4E5.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation D4E5.tmp -
Deletes itself 1 IoCs
Processes:
D4E5.tmppid Process 3848 D4E5.tmp -
Executes dropped EXE 1 IoCs
Processes:
D4E5.tmppid Process 3848 D4E5.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini LB3.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPlduwjkppiol50urr5wsx7xkfc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPxqe5g22d22oooltdef5673e2b.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPgiqannf0ugf11ce6vuboke9x.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
D4E5.tmppid Process 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 3520 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 1576 ONENOTE.EXE 1576 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LB3.exepid Process 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe 2776 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
D4E5.tmppid Process 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp 3848 D4E5.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeDebugPrivilege 2776 LB3.exe Token: 36 2776 LB3.exe Token: SeImpersonatePrivilege 2776 LB3.exe Token: SeIncBasePriorityPrivilege 2776 LB3.exe Token: SeIncreaseQuotaPrivilege 2776 LB3.exe Token: 33 2776 LB3.exe Token: SeManageVolumePrivilege 2776 LB3.exe Token: SeProfSingleProcessPrivilege 2776 LB3.exe Token: SeRestorePrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSystemProfilePrivilege 2776 LB3.exe Token: SeTakeOwnershipPrivilege 2776 LB3.exe Token: SeShutdownPrivilege 2776 LB3.exe Token: SeDebugPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeBackupPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe Token: SeSecurityPrivilege 2776 LB3.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
ONENOTE.EXEpid Process 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE 1576 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exeD4E5.tmpdescription pid Process procid_target PID 2776 wrote to memory of 2092 2776 LB3.exe 89 PID 2776 wrote to memory of 2092 2776 LB3.exe 89 PID 2776 wrote to memory of 3848 2776 LB3.exe 92 PID 2776 wrote to memory of 3848 2776 LB3.exe 92 PID 2776 wrote to memory of 3848 2776 LB3.exe 92 PID 2776 wrote to memory of 3848 2776 LB3.exe 92 PID 944 wrote to memory of 1576 944 printfilterpipelinesvc.exe 93 PID 944 wrote to memory of 1576 944 printfilterpipelinesvc.exe 93 PID 3848 wrote to memory of 3968 3848 D4E5.tmp 101 PID 3848 wrote to memory of 3968 3848 D4E5.tmp 101 PID 3848 wrote to memory of 3968 3848 D4E5.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2092
-
-
C:\ProgramData\D4E5.tmp"C:\ProgramData\D4E5.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4E5.tmp >> NUL3⤵PID:3968
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1312
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C2C28400-E19C-4FDA-8C1F-46DE507F5601}.xps" 1336510105947400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\2RhHf8MzI.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5d58f40f7fa8e48a3859ff9f3d9d34456
SHA1b8e21cb72350eaff42f515b7a80d3ee677fba780
SHA256e6aad7eee4dd78491667aafa099a09e920ca714b7abeb37f9fe8805efad5f678
SHA512a7422a9299b3fd13fe58e4139b119542d0fd5a2e4d805712782bca1023dcfc5d2c7083d671e18323bf2e5f5647b73e428bf10d5a5320bafc6b0c2ae60f7c6219
-
Filesize
316B
MD5f7c2a71eb88dbc296f6f2219e4f03685
SHA1894712e61f16fd1221e209ef1793dabb72a14f8c
SHA256def22d8a877d824871a81902a456d421e81ea2abdf86999669d9a3087d864531
SHA512852fd2569921b36412413cfb3cc194b089be1383421f3210f22ebb2a796bb53189a95bc7db761ba33d6c345588eb9edd5aa48917dca597eba4c546dcb8ab84d4
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
145KB
MD5d7c7a56ab3f51404176fc88436bfeae9
SHA16afe4ea00d198e78f62d5d82fdff618f06417f4b
SHA25639252aae72da8c70fd798205e8a05e3cd545e20099d8faf8a2d5c4be678602dc
SHA512c2f4f7ee55468f29889d525d1b507bb222220dfd79ab0854f04baf9927320abd55da3a4f175f3a2ee79387915e531469e0349ae830366fe7950071e891010640
-
Filesize
4KB
MD5bb16bee60a56ecdffcf40ed1f8faa3fd
SHA1d302c8f9c10270b833799d848dac858a65fd25af
SHA2561aa8787b8eeabb91c55b63e13c04446c23aeab96472b00001256b4c79fff4fe3
SHA512ac40009abea49359b66c27a1a1cfe3c122d07a74fc50968ddd22dd9b1c9f01743e47e26ae3eb9804815c4a48be7955c960ea6569a8f7697e0a5baefa39ba5e3c
-
Filesize
129B
MD56cf56b3b01bf9dd9ae6d4a752c8cad35
SHA17dd5de3184f0cff85ba4b58fed9904c6e2d86b04
SHA2565b167c98af808feb8ecc73d740e0deea3bcc4579b1129cd948481c3bdd2f209b
SHA5129fa65d0ac3292a6f8e3e55550b284c7e894ff2ceb826d8949ba4b1f5c80010af4e2f95b6c06f1d53ae5bba16c81fe29fe1f4a6bd6c5524c8340c1263c44193a5