0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305

Resubmissions

14-07-2024 13:00

240714-p8n9es1elq 10

14-07-2024 13:00

240714-p8metstdra 10

18-06-2024 22:58

240618-2xvnaasglk 10

Analysis

max time kernel
142s
max time network
139s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14-07-2024 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LB3.exe
Size

146KB
MD5

2357ecbcf3b566c76c839daf7ecf2681
SHA1

89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58
SHA256

0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305
SHA512

bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401
SSDEEP

3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\7V7uPExzv.README.txt

Ransom Note

~~~NULLBULGE LOCK - BASED ON LOCKBIT~~~ >>>> Your data is encrypted... but dont freak out If we encrypted you, you majorly fucked up. But... all can be saved But not for free, we require an xmr payment >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption. Life is too short to be sad. Dont be sad money is only paper. Your files are more important than paper right? If we do not give you decrypter then nobody will pay us in the future. To us, our reputation is very important. There is no dissatisfied victim after payment. >>>> You may contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait a while Links for Tor Browser: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/ Link for the normal browser http://group.goocasino.org https://nullbulge.com >>>> Your personal DECRYPTION ID: 217B9D5D58C4AD3CE44DE1C8FFD9A989 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!

URLs

http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/

http://group.goocasino.org

https://nullbulge.com

Signatures

Renames multiple (494) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

Processes:

7DFB.tmp

pid	Process
3076	7DFB.tmp

Executes dropped EXE 1 IoCs

Processes:

7DFB.tmp

pid	Process
3076	7DFB.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

LB3.exe

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini	LB3.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3699363923-1875576828-3287151903-1000\desktop.ini	LB3.exe

Drops file in System32 directory 4 IoCs

Processes:

splwow64.exeprintfilterpipelinesvc.exe

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PP0ys0fru0sx3aw5qe5upy194sb.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPcpd0krm4cajhw3iug2qt_mgi.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPtx_jtk3tkd64u7qz5lto7c7qb.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

LB3.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp"	LB3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

LB3.exe7DFB.tmp

pid	Process
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
3076	7DFB.tmp

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE

Modifies Control Panel 2 IoCs

evasion

Processes:

LB3.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe

Modifies registry class 5 IoCs

Processes:

LB3.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico"	LB3.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

LB3.exeONENOTE.EXE

pid	Process
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
2752	LB3.exe
996	ONENOTE.EXE
996	ONENOTE.EXE

Suspicious behavior: RenamesItself 26 IoCs

Processes:

7DFB.tmp

pid	Process
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp
3076	7DFB.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

LB3.exe

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeDebugPrivilege	2752	LB3.exe
Token: 36	2752	LB3.exe
Token: SeImpersonatePrivilege	2752	LB3.exe
Token: SeIncBasePriorityPrivilege	2752	LB3.exe
Token: SeIncreaseQuotaPrivilege	2752	LB3.exe
Token: 33	2752	LB3.exe
Token: SeManageVolumePrivilege	2752	LB3.exe
Token: SeProfSingleProcessPrivilege	2752	LB3.exe
Token: SeRestorePrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSystemProfilePrivilege	2752	LB3.exe
Token: SeTakeOwnershipPrivilege	2752	LB3.exe
Token: SeShutdownPrivilege	2752	LB3.exe
Token: SeDebugPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeBackupPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe
Token: SeSecurityPrivilege	2752	LB3.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

ONENOTE.EXE

pid	Process
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE
996	ONENOTE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

LB3.exeprintfilterpipelinesvc.exe7DFB.tmp

description	pid	Process	procid_target
PID 2752 wrote to memory of 1852	2752	LB3.exe	77
PID 2752 wrote to memory of 1852	2752	LB3.exe	77
PID 2752 wrote to memory of 3076	2752	LB3.exe	79
PID 2752 wrote to memory of 3076	2752	LB3.exe	79
PID 2752 wrote to memory of 3076	2752	LB3.exe	79
PID 2752 wrote to memory of 3076	2752	LB3.exe	79
PID 3460 wrote to memory of 996	3460	printfilterpipelinesvc.exe	80
PID 3460 wrote to memory of 996	3460	printfilterpipelinesvc.exe	80
PID 3076 wrote to memory of 3720	3076	7DFB.tmp	81
PID 3076 wrote to memory of 3720	3076	7DFB.tmp	81
PID 3076 wrote to memory of 3720	3076	7DFB.tmp	81

C:\Users\Admin\AppData\Local\Temp\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\LB3.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:1852
- C:\ProgramData\7DFB.tmp
  "C:\ProgramData\7DFB.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7DFB.tmp >> NUL
    3⤵
    PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
- Drops file in Windows directory
PID:2528

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{AB36265C-C188-45A0-96BB-F43072E43799}.xps" 133654356174200000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3699363923-1875576828-3287151903-1000\CCCCCCCCCCC

Filesize
129B

MD5
0b12a26b4187ca78d213df57af9d8b27

SHA1
922dcb394f517bf00330a198ed8995b4dd748e2f

SHA256
03c7d77baa5c2624aaf2f2aa1f32f0dee1603cdcc16f7cd4de2a4e8b222b5af2

SHA512
0ef064646ad20c12399cceb72f98ad1fb743bbe084da506a29b7074595880d50d3035121ac5068bee6e926385e8d3bf751ce2ccfd1ad8e1b089554b282596370

Download Submit
C:\7V7uPExzv.README.txt

Filesize
1KB

MD5
97fe2e88c19a9273e801289475f34ac1

SHA1
c498a672409e993771d0cda3325c5943cba47566

SHA256
3cba1456225579d3500262b34be0698c0dcc2e089653763ae77d2ea52aef87d9

SHA512
79ca82a008a25e97d038b0ce3748cfd9699edad434e51370f3f0e1ce39e641eac4b48cac1a8d654b70300ff77bf7a2db833d58cb141ab5b7385d7ca270b79c46

Download Submit
C:\ProgramData\7DFB.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEEEEEE

Filesize
146KB

MD5
5d162fe1695d4eb2d69e2e8f69d2e28e

SHA1
b7c40eb520a77ad7ba0ce409ddff6f7ea1323c63

SHA256
441e9f3d16ddd8a8c180a3e05327c75315634335b378caf9ff7843814ae40555

SHA512
a7d5b043ebe1bcf4459300d9ffaa655eb62930e194a98d192c1ec88966c443a5a2fbfa1181d9af141afd4d0dc8ca99c3d9a6828f6834860da7a510a1807d3153

Download Submit
C:\Users\Admin\AppData\Local\Temp\{74058AFE-473F-4497-9329-54D267736157}

Filesize
4KB

MD5
25c9bdfaf97490cbf9664fec8e084922

SHA1
ab601fc7b556b3715dd425212e36a307dc9b3ffa

SHA256
9134b125bf4608f5bd9f410c8631c39b0d984068f82e685e2caee09ca127e2f8

SHA512
3286b41652ccae7809ec44b06c14800593410415334d688b3d32cbe539c8d4de476abe9dcfce11b7b735bcc24dfb8798535270a27d88e2a4d7c5a8ac3b426215

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
2fa53c20fad1396afc1c2e8c8d36eb71

SHA1
57c74c77375c83ec55d212a37f077e5037ca5bb1

SHA256
ab84f1a1f270c67486ec5cb5c67b8b12cfcc26d423a4d9030a47265058418154

SHA512
9b0a94490ead13a5e40926201b5d289184a708c9016ce10f0b569b6b0e673fc0dee830d6045113b3b4ec4fb2e92cb73d91f94ffdd7380e44e3831b865fff91c8

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3699363923-1875576828-3287151903-1000\DDDDDDDDDDD

Filesize
129B

MD5
e62d0edf51fd83928530c3c2129b2fe2

SHA1
07bdde76d9813e43f7bdbe4fcc4a5998116e4129

SHA256
550c54a5c3bcee861b0db294161987cf6f1b1f1f90ad6f5081832e0eead03eba

SHA512
fe424da8fbe72cf7a8b72efc65f2a8ef46f4d6264ac2d0a9dfc4999287cd721c3ae48d27f0ec690da9e5b20036315aabbd594eca97ecba913f106cfba3c1ff4b

Download Submit
memory/996-2883-0x00007FFFAEA20000-0x00007FFFAEA30000-memory.dmp

Filesize
64KB

Download
memory/996-2882-0x00007FFFAEA20000-0x00007FFFAEA30000-memory.dmp

Filesize
64KB

Download
memory/996-2917-0x00007FFFABB20000-0x00007FFFABB30000-memory.dmp

Filesize
64KB

Download
memory/996-2916-0x00007FFFABB20000-0x00007FFFABB30000-memory.dmp

Filesize
64KB

Download
memory/996-2885-0x00007FFFAEA20000-0x00007FFFAEA30000-memory.dmp

Filesize
64KB

Download
memory/996-2884-0x00007FFFAEA20000-0x00007FFFAEA30000-memory.dmp

Filesize
64KB

Download
memory/2528-2866-0x0000018B10300000-0x0000018B10301000-memory.dmp

Filesize
4KB

Download
memory/2528-2850-0x0000018B0B4B0000-0x0000018B0B4C0000-memory.dmp

Filesize
64KB

Download
memory/2528-2861-0x0000018B0B720000-0x0000018B0B721000-memory.dmp

Filesize
4KB

Download
memory/2528-2854-0x0000018B0B600000-0x0000018B0B610000-memory.dmp

Filesize
64KB

Download
memory/2528-2865-0x0000018B102E0000-0x0000018B102E1000-memory.dmp

Filesize
4KB

Download
memory/2528-2863-0x0000018B0B760000-0x0000018B0B761000-memory.dmp

Filesize
4KB

Download
memory/2752-0-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/2752-1-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/2752-2-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download