Resubmissions
14-07-2024 13:00
240714-p8n9es1elq 1014-07-2024 13:00
240714-p8metstdra 1018-06-2024 22:58
240618-2xvnaasglk 10Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 13:00
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
LB3.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
2357ecbcf3b566c76c839daf7ecf2681
-
SHA1
89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58
-
SHA256
0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305
-
SHA512
bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU
Malware Config
Extracted
C:\7V7uPExzv.README.txt
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
http://group.goocasino.org
https://nullbulge.com
Signatures
-
Renames multiple (630) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
992E.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation 992E.tmp -
Deletes itself 1 IoCs
Processes:
992E.tmppid Process 4024 992E.tmp -
Executes dropped EXE 1 IoCs
Processes:
992E.tmppid Process 4024 992E.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini LB3.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPdorfkpb40l_utxpe8bdw_bffc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPsa9dhbvdgs76y7ejw3fsvwofb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPcbs40o_f5of98dd6x15vm0qsd.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
LB3.exe992E.tmppid Process 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4024 992E.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\Desktop LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico" LB3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LB3.exepid Process 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe 4580 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
992E.tmppid Process 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp 4024 992E.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeDebugPrivilege 4580 LB3.exe Token: 36 4580 LB3.exe Token: SeImpersonatePrivilege 4580 LB3.exe Token: SeIncBasePriorityPrivilege 4580 LB3.exe Token: SeIncreaseQuotaPrivilege 4580 LB3.exe Token: 33 4580 LB3.exe Token: SeManageVolumePrivilege 4580 LB3.exe Token: SeProfSingleProcessPrivilege 4580 LB3.exe Token: SeRestorePrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSystemProfilePrivilege 4580 LB3.exe Token: SeTakeOwnershipPrivilege 4580 LB3.exe Token: SeShutdownPrivilege 4580 LB3.exe Token: SeDebugPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeBackupPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe Token: SeSecurityPrivilege 4580 LB3.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid Process 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE 4012 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exe992E.tmpdescription pid Process procid_target PID 4580 wrote to memory of 2132 4580 LB3.exe 88 PID 4580 wrote to memory of 2132 4580 LB3.exe 88 PID 4468 wrote to memory of 4012 4468 printfilterpipelinesvc.exe 91 PID 4468 wrote to memory of 4012 4468 printfilterpipelinesvc.exe 91 PID 4580 wrote to memory of 4024 4580 LB3.exe 92 PID 4580 wrote to memory of 4024 4580 LB3.exe 92 PID 4580 wrote to memory of 4024 4580 LB3.exe 92 PID 4580 wrote to memory of 4024 4580 LB3.exe 92 PID 4024 wrote to memory of 1396 4024 992E.tmp 93 PID 4024 wrote to memory of 1396 4024 992E.tmp 93 PID 4024 wrote to memory of 1396 4024 992E.tmp 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2132
-
-
C:\ProgramData\992E.tmp"C:\ProgramData\992E.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\992E.tmp >> NUL3⤵PID:1396
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2064
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{338862C5-BDF4-44C3-A1A4-2E22942BFB28}.xps" 1336543562012800002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD50eefb8afd579a9ec6e32f2c7e4be7f33
SHA17e74f5be15ad8b4e1ed99770fae8099cde04156a
SHA256c03efaca0224e753b0d079a25c770bf17403af30b192f4bc58729a40ee8308b0
SHA512ae7d07432433a859332edf942a31daeb9cc3ed1ca4907b9d2090a532d12bb489460f3e5bd1356d33b009df83bbff4b125a0dbc3bd7c285a25015f142e343b22f
-
Filesize
1KB
MD5c881a1b89a5a8a9d0a62b8d39b312c0f
SHA1a0ac7291d7931d0d0c75071f4d8fc46172f57a38
SHA256ce39f1506f1d56a06c4be84098a6099f7e92687f144ce6c0dd7740a464b7c6f4
SHA512e0e535f26bae8889ef6255a4c31085d34a9e7ec5212df9bc35f2682d034fe95e3153031cb59217bc945887b02815abc56cba74d687270dc09cbe0664eb216502
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD529c6b35b32de16a0b5843a174f6dcc0e
SHA179df3962b01c9cc1d53fba4eeab973b489702c64
SHA256960a495fffc84ef58b80a21508017863a476389256463ac868e013cca863b14c
SHA5126f4be9eba9a04bd1e2ac6934ea24b88575641b09a761be1c0749ae2fa087b7128cc4e2f546db57c2bfda140a4482786e2d99ed26264b4858cd20b316a1d16770
-
Filesize
4KB
MD51c5b85eef108e5d07db5ccc2811c60ad
SHA180a237e427dcedacf74a58497f4e67fd88178a64
SHA25603c421b83b5d8dbe48ba4df4c30039122321bd48da1c79c0d059cba64c84a63b
SHA51250ae04d5edcbe20328b99d6043bfa6e1545ed7e066d0d515999f990d25ca4f4525946006cbfdaa2d28d9f1d775a466a4f07226daa4eb14e872ad3a1fdf1eef6f
-
Filesize
129B
MD575bdd79feb05cfee2011572eaf0e7a2e
SHA11474d6de1237494639cce6cfad484e16cc42b5d1
SHA25614d151a92dd614647344e4ceb50b1d75dfe1691f0ae0b73b0bde0ec455e8c027
SHA512bee04087ffdd7d7bbb08c72b530772a78b099ccd7c49839f533f8a50cb4d4bf10276bdb058e28b3c0bbe795fd1f6b94116080a8f389a4494ddd5903a13e852ee