Resubmissions
14-07-2024 13:00
240714-p8n9es1elq 1014-07-2024 13:00
240714-p8metstdra 1018-06-2024 22:58
240618-2xvnaasglk 10Analysis
-
max time kernel
143s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-07-2024 13:00
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
LB3.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
LB3.exe
Resource
win11-20240709-en
windows11-21h2-x64
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
2357ecbcf3b566c76c839daf7ecf2681
-
SHA1
89d9b7c3eff0a15dc9dbbfe2163de7d5e9479f58
-
SHA256
0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305
-
SHA512
bb5630ae44e684f2dfc74478c57bf97a94045501a64022d563e87f2a60d777307cab2b5a14e6764d25a2fd1f27901624c1ee76ca551d5a5e3a21abc4befef401
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepo2NVLiguo/pyEwUS:V6gDBGpvEByocWeauV2gvzwU
Malware Config
Extracted
C:\7V7uPExzv.README.txt
http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion/
http://group.goocasino.org
https://nullbulge.com
Signatures
-
Renames multiple (587) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
D5FE.tmppid Process 5036 D5FE.tmp -
Executes dropped EXE 1 IoCs
Processes:
D5FE.tmppid Process 5036 D5FE.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-95457810-830748662-4054918673-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-95457810-830748662-4054918673-1000\desktop.ini LB3.exe -
Drops file in System32 directory 4 IoCs
Processes:
printfilterpipelinesvc.exesplwow64.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\PP40c4ynkper0gbnacz4nzr057c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP0c08571ha36iak1hf5rlf_2n.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPsoc0r004avv515v0hl6t2py4c.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\7V7uPExzv.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
LB3.exeD5FE.tmppid Process 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 5036 D5FE.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7V7uPExzv\ = "7V7uPExzv" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7V7uPExzv\DefaultIcon\ = "C:\\ProgramData\\7V7uPExzv.ico" LB3.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
LB3.exeONENOTE.EXEpid Process 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 1412 LB3.exe 3688 ONENOTE.EXE 3688 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
D5FE.tmppid Process 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp 5036 D5FE.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeDebugPrivilege 1412 LB3.exe Token: 36 1412 LB3.exe Token: SeImpersonatePrivilege 1412 LB3.exe Token: SeIncBasePriorityPrivilege 1412 LB3.exe Token: SeIncreaseQuotaPrivilege 1412 LB3.exe Token: 33 1412 LB3.exe Token: SeManageVolumePrivilege 1412 LB3.exe Token: SeProfSingleProcessPrivilege 1412 LB3.exe Token: SeRestorePrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSystemProfilePrivilege 1412 LB3.exe Token: SeTakeOwnershipPrivilege 1412 LB3.exe Token: SeShutdownPrivilege 1412 LB3.exe Token: SeDebugPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeBackupPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe Token: SeSecurityPrivilege 1412 LB3.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid Process 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE 3688 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exeD5FE.tmpdescription pid Process procid_target PID 1412 wrote to memory of 2592 1412 LB3.exe 80 PID 1412 wrote to memory of 2592 1412 LB3.exe 80 PID 4944 wrote to memory of 3688 4944 printfilterpipelinesvc.exe 83 PID 4944 wrote to memory of 3688 4944 printfilterpipelinesvc.exe 83 PID 1412 wrote to memory of 5036 1412 LB3.exe 84 PID 1412 wrote to memory of 5036 1412 LB3.exe 84 PID 1412 wrote to memory of 5036 1412 LB3.exe 84 PID 1412 wrote to memory of 5036 1412 LB3.exe 84 PID 5036 wrote to memory of 1184 5036 D5FE.tmp 85 PID 5036 wrote to memory of 1184 5036 D5FE.tmp 85 PID 5036 wrote to memory of 1184 5036 D5FE.tmp 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2592
-
-
C:\ProgramData\D5FE.tmp"C:\ProgramData\D5FE.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D5FE.tmp >> NUL3⤵PID:1184
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4484
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{4AD2A31E-0BA6-4EA1-85D1-07382EDB3D5F}.xps" 1336543562127700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD513940617ff5b0d2bfefca712872116c7
SHA181d0082156ae8a7be6182f9aa0ef33f8ca2a87e1
SHA2566ab2f4a21166ce1da9bd91c3f77fb162fd57135816e87e0d419705f7a1c3ada8
SHA512fba09418771c2b7d31673f148b1b6009362ad89bcec2aca39f60d5dda2c75ed06c89d6ec1394806f43a6ed78f93b280601c2f0d84b996285e6b3428926f7c953
-
Filesize
1KB
MD5cbf0d4c25c5b1ba463485440d9917c49
SHA198163c7b93b587cda6bf1707939a287d81261a33
SHA256709744f105cd9265332d60dc63e201b94302a3b0046046bda3d72d16e0c0e14f
SHA512ad4681d49cb6fab37d15afd47990b3a0040f545d4ba7abae906532709a69243c81315fa24ddfe86fcb6deb3c3458dd3227a4b66d28408a9aa03976f3542da654
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD50fcf148717bbbb8eaee11ef5cfb7d78c
SHA1d2234d9342d082eda94c93293683438356bfc9b3
SHA25683842ec10b5b1f145d04262dd7f9e3f5bcdffc96ee62c1b9d1c299bb60e28efe
SHA5124943cfd725eb7c6b915524b820600d2b61ac517553b96660d59d758764383ed203723db7cfe1d75974afc48391d5218f5103f8a25a09878803177c45476e4fd5
-
Filesize
4KB
MD5d737492a7cdec53b090ac1dea1c074d2
SHA125878294e164dbde6032415298ed3f63b84de757
SHA2564fed82082d472825f7bde916a8cca8eea732c5cd51c208930f5e13cf4608b11a
SHA512416f0b6ab9ced25634f3f3957dd6a19827ecc6bbea94d2289e22da06f858991e0456e9aa6b823bebbfcd2eae9c5499bd08ed88b4b46f8473174f87295b117d91
-
Filesize
129B
MD50415614519051b840e339e3ca4c8e823
SHA17404a4360aaf86add5c5a1a147ebd7daf340cf7e
SHA256d80c6d0030199b209dae16d266bb818398b1fdacaab663405995324ded823b3a
SHA51237e1af86ad5ac5c736b59c4b66ec3aee5708d5bbc30a855eb1fe2bac091aa2c67e71dc54ccf298dfc2a39038e99cc525216c594c8bae6ba256dd7344c7dbc352