Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2024 15:10
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
LB3.exe
-
Size
146KB
-
MD5
e77ed091631caf183dc4141fe8fb51f2
-
SHA1
bbd0c5aba9c95209d29e5b59113e0bae203bf6d6
-
SHA256
54ed464306c9e21af8bbef2b8b95a1f3762722ddbc9b8e1ad9661760909f6975
-
SHA512
3751d62156eaed483cff9f589d2dba6871dabcae61bdfe9f3629cfc49529697521e4cd39f572b99ae6dab189d6e70c0d9be2ca96558060c4cd7b10faf617d3c6
-
SSDEEP
3072:XqJogYkcSNm9V7Dvjh4eL2OAXrsrbWnUroWT:Xq2kc4m9tDj2Fbs2io
Malware Config
Signatures
-
Renames multiple (596) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation A49D.tmp -
Deletes itself 1 IoCs
pid Process 5388 A49D.tmp -
Executes dropped EXE 1 IoCs
pid Process 5388 A49D.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini LB3.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini LB3.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPa9q2yi8wzp77djk32obb9j0cc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPjuqb4cdm1fi9zvkhjiyl476h.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPaj40bc7vna8aauuo90xk3qsw.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\9XjtSQqIP.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\9XjtSQqIP.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5388 A49D.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LB3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A49D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\9XjtSQqIP LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\9XjtSQqIP\DefaultIcon\ = "C:\\ProgramData\\9XjtSQqIP.ico" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.9XjtSQqIP LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.9XjtSQqIP\ = "9XjtSQqIP" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\9XjtSQqIP\DefaultIcon LB3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe 5096 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp 5388 A49D.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeDebugPrivilege 5096 LB3.exe Token: 36 5096 LB3.exe Token: SeImpersonatePrivilege 5096 LB3.exe Token: SeIncBasePriorityPrivilege 5096 LB3.exe Token: SeIncreaseQuotaPrivilege 5096 LB3.exe Token: 33 5096 LB3.exe Token: SeManageVolumePrivilege 5096 LB3.exe Token: SeProfSingleProcessPrivilege 5096 LB3.exe Token: SeRestorePrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSystemProfilePrivilege 5096 LB3.exe Token: SeTakeOwnershipPrivilege 5096 LB3.exe Token: SeShutdownPrivilege 5096 LB3.exe Token: SeDebugPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeBackupPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe Token: SeSecurityPrivilege 5096 LB3.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE 5220 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5096 wrote to memory of 4664 5096 LB3.exe 91 PID 5096 wrote to memory of 4664 5096 LB3.exe 91 PID 436 wrote to memory of 5220 436 printfilterpipelinesvc.exe 98 PID 436 wrote to memory of 5220 436 printfilterpipelinesvc.exe 98 PID 5096 wrote to memory of 5388 5096 LB3.exe 100 PID 5096 wrote to memory of 5388 5096 LB3.exe 100 PID 5096 wrote to memory of 5388 5096 LB3.exe 100 PID 5096 wrote to memory of 5388 5096 LB3.exe 100 PID 5388 wrote to memory of 2968 5388 A49D.tmp 101 PID 5388 wrote to memory of 2968 5388 A49D.tmp 101 PID 5388 wrote to memory of 2968 5388 A49D.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4664
-
-
C:\ProgramData\A49D.tmp"C:\ProgramData\A49D.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A49D.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2968
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4064
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{80953276-7FFF-470B-B55B-53884D88D30C}.xps" 1337710745525600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD54b6b9780cc69e9a7fc8d4155e1e7d81f
SHA17f3cb5b8c80f4b4bb7d6a3b80748cb523a4e0310
SHA256fdb2ee310925d01af07905ed7050f39bd28934ed2f5868a5ff22a8b60758e6a5
SHA5126cd97a5aeb8537597ab84023920e6d2824f3b12dab56dcd74d3f748f3e49f54d226d4c48a5640399e201bbd3ca495136b2a2900ae3d1995fbef13bd30461b9a1
-
Filesize
376B
MD5fc9c064d2cdf480f3433f956ef6b8872
SHA1b3447c96d398ffc75b5c6603abc511666d78d2fa
SHA256b70362efb225063b970f4ebca73a1eb53e1f680b8bc082ba27f34cbc79c05e4f
SHA512aaeb15ca236723112fa9682119790cb8288f0c678da6588bc0dc0d42e8dacd30ba13de6263cf48e6c9df19e20cd184e2da8578eeec650bc8341398d859d4b9c8
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD5f39e67f42ee200c03d13444ec9d1e117
SHA10b7f9cb9da7897a03305de631f7f1bffdab93ccb
SHA256222b9c3d03d0630312a96883609dc52c82f5955218732030ce084cce7cc004be
SHA512e87c8f0a6fc6b25eebc2131b8f78f6e6bd7b0185fad1d08ca1ef52db7dd600a0ff8e259112f96124ecad4a98a2cfb962c59de901a03f05464a688d1ff4e95029
-
Filesize
4KB
MD5260cb60346551eb828137c785eee6ebc
SHA19ab3becc00355e5b958f293ac6a1e6b86321683b
SHA2560aa45c6ecf41ee8464e44ccfbdf0653df865676bc65d20159a613d733783bc42
SHA5122c621951fee862dc22f97aa1289a2bc0514a63eebd9bf4e9bc824c1dc08b0b6e5eaa4887cd8b21c0af4b65dcfa5b546f63f9e88b77623ce9474477132af4c195
-
Filesize
129B
MD5840d16094720aa6f792f4f9c9e8c3f7c
SHA161d999e4b6d7686319f4d4abd476c1c4364b8731
SHA256902e4fca60b5d7bb289b3b00613286b4424a63e161f5a3bbbbfc3044194550ac
SHA5121127ee92ccf9ebf75f817027655e68d0e8beb1450b282f62e393f8af04ee933f4ff2dafb4f4fcaa6ff466d00278bf7b2ca7d1a1e72515696529d46ec958c112f