Resubmissions
14-07-2024 13:00
240714-p8n9es1elq 1014-07-2024 13:00
240714-p8metstdra 1018-06-2024 22:58
240618-2xvnaasglk 10Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 13:00
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
LB3.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
LB3.exe
Resource
win11-20240709-en
windows11-21h2-x64
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
2357ecbcf3b566c76c839daf7ecf2681
-
SHA1
89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58
-
SHA256
0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305
-
SHA512
bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU
Malware Config
Extracted
C:\7V7uPExzv.README.txt
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
http://group.goocasino.org
https://nullbulge.com
Signatures
-
Renames multiple (619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
E0BC.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation E0BC.tmp -
Deletes itself 1 IoCs
Processes:
E0BC.tmppid Process 64 E0BC.tmp -
Executes dropped EXE 1 IoCs
Processes:
E0BC.tmppid Process 64 E0BC.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini LB3.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPtwam3ah0sxs06kz14a66nanob.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP0ie5285do08tq1z3zv3av7nfb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPh4nx683zrvbl5vs5v0bkfqxod.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
LB3.exeE0BC.tmppid Process 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 64 E0BC.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\Desktop LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv LB3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LB3.exepid Process 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe 3288 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
E0BC.tmppid Process 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp 64 E0BC.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeDebugPrivilege 3288 LB3.exe Token: 36 3288 LB3.exe Token: SeImpersonatePrivilege 3288 LB3.exe Token: SeIncBasePriorityPrivilege 3288 LB3.exe Token: SeIncreaseQuotaPrivilege 3288 LB3.exe Token: 33 3288 LB3.exe Token: SeManageVolumePrivilege 3288 LB3.exe Token: SeProfSingleProcessPrivilege 3288 LB3.exe Token: SeRestorePrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSystemProfilePrivilege 3288 LB3.exe Token: SeTakeOwnershipPrivilege 3288 LB3.exe Token: SeShutdownPrivilege 3288 LB3.exe Token: SeDebugPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeBackupPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe Token: SeSecurityPrivilege 3288 LB3.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid Process 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE 208 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exeE0BC.tmpdescription pid Process procid_target PID 3288 wrote to memory of 3180 3288 LB3.exe 89 PID 3288 wrote to memory of 3180 3288 LB3.exe 89 PID 4300 wrote to memory of 208 4300 printfilterpipelinesvc.exe 92 PID 4300 wrote to memory of 208 4300 printfilterpipelinesvc.exe 92 PID 3288 wrote to memory of 64 3288 LB3.exe 93 PID 3288 wrote to memory of 64 3288 LB3.exe 93 PID 3288 wrote to memory of 64 3288 LB3.exe 93 PID 3288 wrote to memory of 64 3288 LB3.exe 93 PID 64 wrote to memory of 2216 64 E0BC.tmp 94 PID 64 wrote to memory of 2216 64 E0BC.tmp 94 PID 64 wrote to memory of 2216 64 E0BC.tmp 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3180
-
-
C:\ProgramData\E0BC.tmp"C:\ProgramData\E0BC.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E0BC.tmp >> NUL3⤵PID:2216
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1536
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{244CA781-401F-4D04-8954-88C1F1F0C43B}.xps" 1336543562343300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5e7b05fe9cd4d8a818dd130ed5fdf384c
SHA1ff09ecbf5b64cac2fae3c7459b95e26fd16f657d
SHA256d768337ecb054bb1f21d48222d1483e39736de8092580c0d9afcc0adbe68e642
SHA5121b9670b5a720d916dbae15ac76acbeb58cdf4d16f4eac42f62805c58e529eee5e6ceb754dded9041878bb62644e6a4d3dd6ad56f60d5ef2198e402fd93e28d9b
-
Filesize
1KB
MD5736a444ed4cd4b187d5a57befa0931a8
SHA1a3b181f88ed111931ac0568bd3ea38da8356a60d
SHA25642b0b8b673731ce75403e378f8876ad6d759df8d6db72e047e28e0de1d00d8c9
SHA512d5aa992908ed4979d83d9fff7450c0375a8176b7cc5c049def948213a92965c58873198b3d2fb41008900fb92aa4be0f26e6d1d237c8002d92f2685cd8c74939
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD55ff08a563a83f2240c5f4795c33232b6
SHA1ccc1e401416e06f5b1de71b7bda512d44d5e07d5
SHA256ab76e40ae9050e5a877e43c8ac5ef46d229cdb62a1400dd82f3e2f27d322aa7e
SHA512725ec660a6552f693f1cabbcca4f8e7665ea66e2b9a88a5be44dddcc2db2c849378c0e537e1fb739fdcd83ab4cb2acabb0ae99e50d899177042fa944f6cdd67a
-
Filesize
4KB
MD5fda7b5d67ecce8cfc1c1018f777a111b
SHA1922eb8b0e3d27dcf31c96e486e0f1bf550b7b577
SHA2567d21c7ffad2b4723b45f249c4fe3fb1aae107a98c88e6e8f1315d157010fc0bf
SHA512fbf275951d7dd504d995d6dfd4bb9bb81156a7d857e21311f76e9a8694b12b6b4ecae95e1d10ed28e53b8486b113c2bd4cd15115e98723f51dd054ec5c094110
-
Filesize
129B
MD57b3d79fd9363e5baa2be8f64bbbe2f27
SHA18c6e86d509e499c9d1f4c41cc17a69f88adec822
SHA2566f4aaec903f9c4e9c2969c860ee285a765087bed502cf6761ae23d608d905264
SHA512e3f65b404d6c6cf41faa414932ed01515e6ae627950215f3af6bb4ac53788b4fa50c5b37b01e97456b520154c90a8e65d91ae90b992196e99983867545aa454b