lockbit | 7e32888f7a6d5b70bcdb690a82f1761607b1ab6398441228cc4ac5a098cd733b

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LB3.exe
Size

153KB
MD5

6b891bc9b12b189cf8a916062db75da3
SHA1

5f808c54f816ac7ff06695c831236453e49d63bf
SHA256

7e32888f7a6d5b70bcdb690a82f1761607b1ab6398441228cc4ac5a098cd733b
SHA512

1405c0fecf41e6439638244098cf8dc80b5cbb3e9645ecdd1e2fe3b38c21b0028c1075d0fcb922d83b33d980ac405ad825e3dda202a78dac0be6a14f226fb0d7
SSDEEP

3072:c6glyuxE4GsUPnliByocWeppFtwRpkSqNmv2:c6gDBGpvEByocWeDep9SN

Score

10^/10

lockbit defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\iUwG9Yr05.README.txt

Family

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 312A08A2A9819E7E48525603D1A7E52E >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Emails

[email protected]

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

http://lockbitapt.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Lockbit family
lockbit
Renames multiple (619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	CD63.tmp

Deletes itself 1 IoCs

pid	Process
3816	CD63.tmp

Executes dropped EXE 1 IoCs

pid	Process
3816	CD63.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	LB3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	LB3.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\PP97l36rwv3gh1rux5ith6j0pp.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPouz70e64x2tvin8r6ei47c4d.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PP5rzh08qgr6knf1uvvx7sfw_6.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\iUwG9Yr05.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\iUwG9Yr05.bmp"	LB3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
3816	CD63.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LB3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CD63.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iUwG9Yr05\ = "iUwG9Yr05"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iUwG9Yr05\DefaultIcon	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\iUwG9Yr05	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\iUwG9Yr05\DefaultIcon\ = "C:\\ProgramData\\iUwG9Yr05.ico"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iUwG9Yr05	LB3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe
4948	LB3.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp
3816	CD63.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeDebugPrivilege	4948	LB3.exe
Token: 36	4948	LB3.exe
Token: SeImpersonatePrivilege	4948	LB3.exe
Token: SeIncBasePriorityPrivilege	4948	LB3.exe
Token: SeIncreaseQuotaPrivilege	4948	LB3.exe
Token: 33	4948	LB3.exe
Token: SeManageVolumePrivilege	4948	LB3.exe
Token: SeProfSingleProcessPrivilege	4948	LB3.exe
Token: SeRestorePrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSystemProfilePrivilege	4948	LB3.exe
Token: SeTakeOwnershipPrivilege	4948	LB3.exe
Token: SeShutdownPrivilege	4948	LB3.exe
Token: SeDebugPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeBackupPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe
Token: SeSecurityPrivilege	4948	LB3.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE
4808	ONENOTE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3272	4948	LB3.exe	91
PID 4948 wrote to memory of 3272	4948	LB3.exe	91
PID 316 wrote to memory of 4808	316	printfilterpipelinesvc.exe	98
PID 316 wrote to memory of 4808	316	printfilterpipelinesvc.exe	98
PID 4948 wrote to memory of 3816	4948	LB3.exe	99
PID 4948 wrote to memory of 3816	4948	LB3.exe	99
PID 4948 wrote to memory of 3816	4948	LB3.exe	99
PID 4948 wrote to memory of 3816	4948	LB3.exe	99
PID 3816 wrote to memory of 4596	3816	CD63.tmp	101
PID 3816 wrote to memory of 4596	3816	CD63.tmp	101
PID 3816 wrote to memory of 4596	3816	CD63.tmp	101

C:\Users\Admin\AppData\Local\Temp\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\LB3.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:3272
- C:\ProgramData\CD63.tmp
  "C:\ProgramData\CD63.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CD63.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3204

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:316
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{58E54111-37CF-4E22-88D3-60F7A575A8BA}.xps" 133769493953110000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\BBBBBBBBBBB

Filesize
129B

MD5
c5d96acbf3891d516bfcf26ae9963076

SHA1
0e5c9f25ff91caac6c97182a1c8ed10566648029

SHA256
7be5208d551d18f3cb6724e5d4bfa2cee225dcebf79ebbf72f7e90e3a7ba2fba

SHA512
779c1e81665aa9ed1e31a5d5bf7cf5aff50320fc08855d32ebea724ddfc6abcdd4078e07743abd829b1b248e4e31ea90afb8470bedfeca4c72e4ec5d922dc4ee

Download Submit
C:\ProgramData\CD63.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CCCCCCC

Filesize
153KB

MD5
80e6c68a13671c3fa7db60a718004d17

SHA1
2ce4653cc3f6ac46f91f45abdf8c0b625198bad6

SHA256
df0eed57bbc37c9167297e40cd4cfdccd94b91addef026c95f097812a78ac7d1

SHA512
48e60a500859df9a790a24eae264c70d7829ee5283d162ff88dcd42aa0c41425a1083e065c29974b8bfb8f86ccb32f7276028294f30629aa8db5281c10309970

Download Submit
C:\Users\Admin\AppData\Local\Temp\{FA92AC2D-9717-4595-9447-44768F24AA2A}

Filesize
4KB

MD5
16a9a96894485f423e27ded81eb3d108

SHA1
ddc92b1c91a5e2e838abc9c9fa54d87d9966d1b3

SHA256
92fbdf373df977bc56681d22ef4dbbe01c151f35fa1aff148c3384e7c5118d8d

SHA512
975ffb6107216fb17596edf4519ef327f58df55e9654a30f4316c40bf6031eae514fb80439d387b65801d0a836e530ef235df94d01d84985d8e294c3469663f0

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
76dae995c2d4e5661affb03ecfe1bb9e

SHA1
802e0a9990f96e542a21028d1c289f89d56976eb

SHA256
ffc73b19835128bafdb077e2db75bdb73140c3d69d2c2012059ca697213e5330

SHA512
158da63a1ae21abdc7d09d59acb899b0f5781cecf807dc1adaa97030720f7ccee1ec188919539d1139ee9230f54254f940df52e83e1d49004c605b1298b66a2e

Download Submit
C:\iUwG9Yr05.README.txt

Filesize
6KB

MD5
bd509d422f7b9925a0b250b1a40c94d3

SHA1
3536b28360f2d05f9a35de4f04b9e99fceda9844

SHA256
4fe72dbc36be07629df9839e3af92fe8697fccfcaa6f7c53e3b6d8350790927b

SHA512
e5b77347113f2a0fc870c869b0e4b5bd39ae46cd062a2831f2af9d30ec099d7f9b8731daef60327995293c646da86fd7f14a26ffc663dc688a5f594dd767a9b9

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\DDDDDDDDDDD

Filesize
129B

MD5
8ed8d897668bf2d144b32cbc4993c175

SHA1
fec12768e156acaf1d50c53cf8a81461dd9e5d3d

SHA256
58ec60778d53b6e77b8a93ff2134cace9886f4361d58bd347855103334bdbde7

SHA512
b1d12798b4e70f8a15afba11d14a1103e162e82f2149d124249543a1a6e5e90a7230996c13e23b80b2133a56e9c5fd64ce4fbf0cbb34dae5aa45b1183fcfefd4

Download Submit
memory/4808-2855-0x00007FFD14790000-0x00007FFD147A0000-memory.dmp

Filesize
64KB

Download
memory/4808-2852-0x00007FFD14790000-0x00007FFD147A0000-memory.dmp

Filesize
64KB

Download
memory/4808-2854-0x00007FFD14790000-0x00007FFD147A0000-memory.dmp

Filesize
64KB

Download
memory/4808-2853-0x00007FFD14790000-0x00007FFD147A0000-memory.dmp

Filesize
64KB

Download
memory/4808-2856-0x00007FFD14790000-0x00007FFD147A0000-memory.dmp

Filesize
64KB

Download
memory/4808-2885-0x00007FFD11E30000-0x00007FFD11E40000-memory.dmp

Filesize
64KB

Download
memory/4808-2886-0x00007FFD11E30000-0x00007FFD11E40000-memory.dmp

Filesize
64KB

Download
memory/4948-2836-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/4948-2834-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/4948-2835-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/4948-0-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/4948-1-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/4948-2-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download