Analysis
-
max time kernel
419s -
max time network
420s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2024 15:00
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20241010-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
e77ed091631caf183dc4141fe8fb51f2
-
SHA1
bbd0c5aba9c95209d29e5b59113e0bae203bf6d6
-
SHA256
54ed464306c9e21af8bbef2b8b95a1f3762722ddbc9b8e1ad9661760909f6975
-
SHA512
3751d62156eaed483cff9f589d2dba6871dabcae61bdfe9f3629cfc49529697521e4cd39f572b99ae6dab189d6e70c0d9be2ca96558060c4cd7b10faf617d3c6
-
SSDEEP
3072:XqJogYkcSNm9V7Dvjh4eL2OAXrsrbWnUroWT:Xq2kc4m9tDj2Fbs2io
Malware Config
Signatures
-
Renames multiple (621) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D66B.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation D66B.tmp -
Deletes itself 1 IoCs
Processes:
D66B.tmppid Process 3860 D66B.tmp -
Executes dropped EXE 1 IoCs
Processes:
D66B.tmppid Process 3860 D66B.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
LB3.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini LB3.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPedgpytj4j23ns4zvixxkru5ab.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPvg0mencqbq1dnc_4l5jz7m3pd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP_0l6nf0z8fdgb1218jzg5lbcc.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\9XjtSQqIP.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\9XjtSQqIP.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
D66B.tmppid Process 3860 D66B.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exeLB3.exeD66B.tmpdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LB3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D66B.tmp -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
LB3.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop LB3.exe -
Modifies registry class 5 IoCs
Processes:
LB3.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\9XjtSQqIP\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\9XjtSQqIP LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\9XjtSQqIP\DefaultIcon\ = "C:\\ProgramData\\9XjtSQqIP.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.9XjtSQqIP LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.9XjtSQqIP\ = "9XjtSQqIP" LB3.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 3080 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 3664 ONENOTE.EXE 3664 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
LB3.exepid Process 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe 4600 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
D66B.tmppid Process 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp 3860 D66B.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LB3.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeDebugPrivilege 4600 LB3.exe Token: 36 4600 LB3.exe Token: SeImpersonatePrivilege 4600 LB3.exe Token: SeIncBasePriorityPrivilege 4600 LB3.exe Token: SeIncreaseQuotaPrivilege 4600 LB3.exe Token: 33 4600 LB3.exe Token: SeManageVolumePrivilege 4600 LB3.exe Token: SeProfSingleProcessPrivilege 4600 LB3.exe Token: SeRestorePrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSystemProfilePrivilege 4600 LB3.exe Token: SeTakeOwnershipPrivilege 4600 LB3.exe Token: SeShutdownPrivilege 4600 LB3.exe Token: SeDebugPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeBackupPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe Token: SeSecurityPrivilege 4600 LB3.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
ONENOTE.EXEpid Process 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
LB3.exeprintfilterpipelinesvc.exeD66B.tmpdescription pid Process procid_target PID 4600 wrote to memory of 4932 4600 LB3.exe 88 PID 4600 wrote to memory of 4932 4600 LB3.exe 88 PID 4624 wrote to memory of 3664 4624 printfilterpipelinesvc.exe 93 PID 4624 wrote to memory of 3664 4624 printfilterpipelinesvc.exe 93 PID 4600 wrote to memory of 3860 4600 LB3.exe 94 PID 4600 wrote to memory of 3860 4600 LB3.exe 94 PID 4600 wrote to memory of 3860 4600 LB3.exe 94 PID 4600 wrote to memory of 3860 4600 LB3.exe 94 PID 3860 wrote to memory of 3324 3860 D66B.tmp 95 PID 3860 wrote to memory of 3324 3860 D66B.tmp 95 PID 3860 wrote to memory of 3324 3860 D66B.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4932
-
-
C:\ProgramData\D66B.tmp"C:\ProgramData\D66B.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D66B.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:3324
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:528
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{728EB6C1-DABB-4082-88CC-9750F4919947}.xps" 1337710686670200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3664
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\9XjtSQqIP.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5336c14a5a741086e8439e7706d2cfa39
SHA12cf0e99aeb719c45dac9df1066163c706b360fcf
SHA256d93cf3560164088b76634df4b8c4a6f5fcff687894823043d36ec0b0228733d1
SHA5129e0868a286915dc2efcd87ae0ce430376d4eb3996eba34a3d724b8dc60c135ec55ac1393fa26b8727772a9d9f34f6f896f84fda3c9b641ad8db3e02f2d7a226b
-
Filesize
376B
MD5fc9c064d2cdf480f3433f956ef6b8872
SHA1b3447c96d398ffc75b5c6603abc511666d78d2fa
SHA256b70362efb225063b970f4ebca73a1eb53e1f680b8bc082ba27f34cbc79c05e4f
SHA512aaeb15ca236723112fa9682119790cb8288f0c678da6588bc0dc0d42e8dacd30ba13de6263cf48e6c9df19e20cd184e2da8578eeec650bc8341398d859d4b9c8
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5d86f0f685feefac342889548cee52154
SHA1b4563077f1d2108553b341797afc58d74aea7008
SHA2562a3947891767bd38dcf3f8b6365c99518676d2b6911ecb3da533495e91208871
SHA51248a0f0b2f4e31cc429105241d93d41608bdbdbeeb049b1439b5c6e7d039345ec6a14674411a629eb6531d127a1df1d5cc084212ab7c47a5707e54fe982fe15c2
-
Filesize
129B
MD5b5587dde54fece9bd008ccab90017246
SHA17a9c08ed1ad63e8f48618a24676c37a4134289b7
SHA2562ef2961007095dc364842a37327af7d865da28fe4ff993ea9fc6ed596756be01
SHA5126214516d6b0effd2e1913f51557b46636a97a46c7f1c62f8b66f2750960c3834db713fa15c7351f99b69e2beb335d200a90565a4458984a3cd49dac68eeb009e