e097f98ea3416330ed2fd7856743d68a7ca880c6d57e8c264a384a112ac5a390

General

Target

lk.exe
Size

146KB
MD5

7f6830b77ad13b244bc5d702d67137bf
SHA1

1fbd763388a3e9679ac66b35da8a78e041611fe4
SHA256

e097f98ea3416330ed2fd7856743d68a7ca880c6d57e8c264a384a112ac5a390
SHA512

488cb83c7267cfc70989e09489373f4372325531f7c02b1711fbdf6dfeaa377c39b84d5e971136e0e41d0a6dcde52ec4d21a749169eedb9e9ba43eb9caf077de
SSDEEP

3072:c6glyuxE4GsUPnliByocWep0XL63DjDeprS:c6gDBGpvEByocWeOmuNS

Score

9^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (333) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

9656.tmp

pid process

2144 9656.tmp
Executes dropped EXE 1 IoCs

Processes:

9656.tmp

pid process

2144 9656.tmp
Loads dropped DLL 1 IoCs

Processes:

lk.exe

pid process

2876 lk.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

Processes:

lk.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini	lk.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini	lk.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

lk.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\XQk8iLzOQ.bmp"	lk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\XQk8iLzOQ.bmp"	lk.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

lk.exe9656.tmp

pid process

2876 lk.exe
2876 lk.exe
2876 lk.exe
2876 lk.exe
2144 9656.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

lk.exe9656.tmpcmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9656.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

lk.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\Desktop	lk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\Desktop\WallpaperStyle = "10"	lk.exe

Modifies registry class 5 IoCs

Processes:

lk.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XQk8iLzOQ\DefaultIcon	lk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XQk8iLzOQ	lk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XQk8iLzOQ\DefaultIcon\ = "C:\\ProgramData\\XQk8iLzOQ.ico"	lk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.XQk8iLzOQ	lk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.XQk8iLzOQ\ = "XQk8iLzOQ"	lk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

lk.exe

pid	process
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe
2876	lk.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

9656.tmp

pid	process
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp
2144	9656.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

lk.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeDebugPrivilege	2876	lk.exe
Token: 36	2876	lk.exe
Token: SeImpersonatePrivilege	2876	lk.exe
Token: SeIncBasePriorityPrivilege	2876	lk.exe
Token: SeIncreaseQuotaPrivilege	2876	lk.exe
Token: 33	2876	lk.exe
Token: SeManageVolumePrivilege	2876	lk.exe
Token: SeProfSingleProcessPrivilege	2876	lk.exe
Token: SeRestorePrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSystemProfilePrivilege	2876	lk.exe
Token: SeTakeOwnershipPrivilege	2876	lk.exe
Token: SeShutdownPrivilege	2876	lk.exe
Token: SeDebugPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeBackupPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe
Token: SeSecurityPrivilege	2876	lk.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

lk.exe9656.tmp

description	pid	process	target process
PID 2876 wrote to memory of 2144	2876	lk.exe	9656.tmp
PID 2876 wrote to memory of 2144	2876	lk.exe	9656.tmp
PID 2876 wrote to memory of 2144	2876	lk.exe	9656.tmp
PID 2876 wrote to memory of 2144	2876	lk.exe	9656.tmp
PID 2876 wrote to memory of 2144	2876	lk.exe	9656.tmp
PID 2144 wrote to memory of 2128	2144	9656.tmp	cmd.exe
PID 2144 wrote to memory of 2128	2144	9656.tmp	cmd.exe
PID 2144 wrote to memory of 2128	2144	9656.tmp	cmd.exe
PID 2144 wrote to memory of 2128	2144	9656.tmp	cmd.exe

C:\Users\Admin\AppData\Local\Temp\lk.exe
"C:\Users\Admin\AppData\Local\Temp\lk.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876

C:\ProgramData\9656.tmp
"C:\ProgramData\9656.tmp"
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9656.tmp >> NUL
3⤵
- System Location Discovery: System Language Discovery
PID:2128

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x14c
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\LLLLLLLLLLL

Filesize
129B

MD5
52b0adf62990590eee6229a9a0f76861

SHA1
220fbbd3ad461e7c0e983b6f2ef4daaad01b1350

SHA256
9023a90265171dfe6a26d01558b974b060ac8821b90d876f95c7361564f0994b

SHA512
df56ef1b640eea469de667c97245e969c07f3c8093d040937a48b5304deeae2edc47cf93049a262a846fb4461d8e11c9ba7fcfa1367df6630617d7ced7c53efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDD

Filesize
146KB

MD5
ce188eb730844aa46ffa99c420b9d913

SHA1
1c7fa0d542accb478c9cf0f87ce2c65d91ed7988

SHA256
a319d59c0d32b75dff8b5bb4808968fe421c3b2dedfc4f0e5bb7f02323f164fd

SHA512
4f586cc67ab5faf444471a903b28df65aceaadb621c95f55db5b1e70df6f6a5dd2ebf5f22db6bfc8695fb139878c8c0d11fc162c1793fa28a3ec530ca0521f9a

Download Submit
C:\XQk8iLzOQ.README.txt

Filesize
343B

MD5
72b1ffaeb7de456483f491ecceadb088

SHA1
ee1953abc295245ab01f35a4a823883826bf2b41

SHA256
eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7

SHA512
c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2257386474-3982792636-3902186748-1000\DDDDDDDDDDD

Filesize
129B

MD5
da634a9ec1c124d701419ca58ec8fa85

SHA1
3cc2a4801bfdefde435bbf460157eb4ea2a181c0

SHA256
2be29134faafc42a4d43dc1e972f3dd5ed3a06df4d1cfc84824e25f4af4cb189

SHA512
52287ca130c0c9a1ad528a22145d0d77a3a999d56439bae0b1ca4d2949fc9758096519607d52965883d01220a9bc0ec213bc1d5bbdd1f764bdba71ba74537c7f

Download Submit
\ProgramData\9656.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
memory/2144-868-0x0000000002280000-0x00000000022C0000-memory.dmp

Filesize
256KB

Download
memory/2144-871-0x000000007EF20000-0x000000007EF21000-memory.dmp

Filesize
4KB

Download
memory/2144-870-0x000000007EF80000-0x000000007EF81000-memory.dmp

Filesize
4KB

Download
memory/2144-869-0x0000000002280000-0x00000000022C0000-memory.dmp

Filesize
256KB

Download
memory/2144-866-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/2144-901-0x000000007EF60000-0x000000007EF61000-memory.dmp

Filesize
4KB

Download
memory/2144-900-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/2876-0-0x0000000002440000-0x0000000002480000-memory.dmp

Filesize
256KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads