Malware Analysis Report

2025-01-22 20:49

Sample ID 241126-wnvn2asmhz
Target LockBit-Black-Builder-main.zip
SHA256 34ae59b7acc09c2e82625640cae82c5158b649db1418ddbaa24138b51f1722c5
Tags
discovery lockbit ransomware spyware stealer blackmatter defense_evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

34ae59b7acc09c2e82625640cae82c5158b649db1418ddbaa24138b51f1722c5

Threat Level: Known bad

The file LockBit-Black-Builder-main.zip was found to be: Known bad.

Malicious Activity Summary

discovery lockbit ransomware spyware stealer blackmatter defense_evasion

Blackmatter family

Lockbit family

Lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (358) files with added filename extension

Renames multiple (629) files with added filename extension

Renames multiple (624) files with added filename extension

Renames multiple (371) files with added filename extension

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Deletes itself

Executes dropped EXE

Indicator Removal: File Deletion

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Sets desktop wallpaper using registry

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Modifies Control Panel

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Opens file in notepad (likely ransom note)

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-26 18:04

Signatures

Blackmatter family

blackmatter

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 67.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 404 -ip 404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 264

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

memory/404-0-0x0000000000400000-0x0000000000429000-memory.dmp

memory/404-1-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe"

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20241010-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe"

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20241010-en

Max time kernel

122s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 88

Network

N/A

Files

memory/1796-0-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1796-1-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1476 -ip 1476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 264

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp

Files

memory/1476-0-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1476-1-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\keygen.exe"

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20240903-en

Max time kernel

122s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 102.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20240903-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_pass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 88

Network

N/A

Files

memory/2300-0-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2300-1-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20241023-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (358) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\D77B.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\D77B.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Indicator Removal: File Deletion

defense_evasion

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\HHuYRxB06.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\HHuYRxB06.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\D77B.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHuYRxB06 C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHuYRxB06\DefaultIcon\ = "C:\\ProgramData\\HHuYRxB06.ico" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.HHuYRxB06 C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.HHuYRxB06\ = "HHuYRxB06" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHuYRxB06\DefaultIcon C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe"

C:\ProgramData\D77B.tmp

"C:\ProgramData\D77B.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D77B.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/1972-0-0x0000000000160000-0x00000000001A0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini

MD5 04f628eee85cc0c10931243d7fa9f956
SHA1 0c21e6ae6f1c7e051864eb3f181b3d113e838aa8
SHA256 74436b820296c09cdfa83eef740e6495039588c01832d47ae136cfc178c6518d
SHA512 4352008ff101fe30d3297e0e5747a24d8426a4a8f5d16295cd21ce0463297739defe56ad0914226a1b71044ada7b1ea5330f88f2d42fe6c116d7a729f481295d

C:\HHuYRxB06.README.txt

MD5 dfa750e4b87581175759b15574a033de
SHA1 0736dc774a1a93fc52d17955a080633c8b214577
SHA256 5db35568702b34111f390463740726af9a71fd624c1f3dedfa9ca54fa54ea8fd
SHA512 3a47be694b21f191717ca0bc705c1d5b12c795de46a99c5c7c6ffce85d64451d22db623f00091ae4ed9231ebbdd8bbaa49a5b86528cfd90eda0756c09d437011

F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\BBBBBBBBBBB

MD5 bb46472d20ceb59233d38e05d92ea00c
SHA1 267655591f04566b062162e3b216262982efae14
SHA256 4d505ae74c033cc1256fc2ae84feb5db192f195dada75d2b233c63046a474e4f
SHA512 97270f570042b3803eab0668d3193de49b064e4ca146e675f3520565e446218c18a60dbfa1d2249314019429e4658287e2d3ae682eefba758be055d4bc1fabe8

\ProgramData\D77B.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1308-897-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1308-902-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/1308-901-0x00000000003A0000-0x00000000003E0000-memory.dmp

memory/1308-900-0x00000000003A0000-0x00000000003E0000-memory.dmp

memory/1308-899-0x000000007EF80000-0x000000007EF81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\DDDDDDD

MD5 08f5f12a9409ed3e58030fafcb7556bb
SHA1 fbaeb416d8bdc5342f8090ddc24d54ecbc4a46fd
SHA256 bb3092bff6d36d25e695ff5781d47719bfbfaf6c6562be703b72c144db0be786
SHA512 b8440a921f5340ccb458544ff021626da42c7bd2c4c65b08a9f003340b232c50bf41bea29eb7352264bd83eb83d0ebaa4c6890dfb15db5b719c9166dd5d1b2a8

memory/1308-932-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/1308-931-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20241010-en

Max time kernel

146s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3Decryptor.exe"

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\builder.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\keygen.exe"

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win7-20240729-en

Max time kernel

67s

Max time network

24s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (371) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\FD62.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\FD62.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Indicator Removal: File Deletion

defense_evasion

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ZImkTWSLZ.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ZImkTWSLZ.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\FD62.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\FD62.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ZImkTWSLZ C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ZImkTWSLZ\ = "ZImkTWSLZ" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZImkTWSLZ\DefaultIcon C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZImkTWSLZ C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZImkTWSLZ\DefaultIcon\ = "C:\\ProgramData\\ZImkTWSLZ.ico" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe"

C:\ProgramData\FD62.tmp

"C:\ProgramData\FD62.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FD62.tmp >> NUL

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ZImkTWSLZ.README.txt

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x148

Network

N/A

Files

memory/2540-0-0x0000000000210000-0x0000000000250000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\AAAAAAAAAAA

MD5 a8fbec7e796cacec3a19874d870b261b
SHA1 8261454843f956ffc1ce9140803d7e7ac82ff10e
SHA256 0a74422de43f63d48af81de81802be749fbc7537915d8124d7fbf7f6d2da0e81
SHA512 fcc500559ee41437e21008eae812c1895ab7f40d52e641219ba2df3ff4699a9fa08ad3c806f0f2d5d40204c01a056f1e9e08e82bbd038b5ce1c9c75fb3ac09af

F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\EEEEEEEEEEE

MD5 75ddc3a6acb1865c4c1a5c4b9a674ed6
SHA1 a16597aaca37c505bd2e089899fc8b0bfbf04432
SHA256 63331b45ef44d64b9e311277d32a1265d58fc207794e72e88cec4c50e00995a2
SHA512 09fe02ff2be64d0281ccbd840c747b974dd1902160f029bd0bc6de6cbd432a6dcf7a93ea8b3e32100329ac83d5be00f4990c2b8e89cc59385f82889a18d8e6cf

C:\ZImkTWSLZ.README.txt

MD5 c99286949a888ffaf1ece9528ace6980
SHA1 65352b807fbdb745271347bf8fb839513a98beb6
SHA256 2c31a092980065973477e7101de9b7a63cc130c270c1c0c9087f2675a85620f6
SHA512 83fe7297520b78d3cd862f6a3f4f0565eac479a74218af712a66db7c1d0c10d2d85fe79df66eac3187cb6f256d088c0a68a96f8193a2c2c168e49d3326970321

\ProgramData\FD62.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2376-909-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2376-908-0x00000000004E0000-0x0000000000520000-memory.dmp

memory/2376-907-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2376-906-0x00000000004E0000-0x0000000000520000-memory.dmp

memory/2376-904-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\DDDDDDD

MD5 594bc8cbc0e6b6fb2e4742af8f30b5a3
SHA1 81265187ccbf9bb158d32b225d17025a49ea7dd2
SHA256 faedd3f78a67ca685a18e26f3c38d07d6b52e159107baa7dc7afae6733794f04
SHA512 0f39ffac94813d9ab6496b4c309fad4fd6c036f770b4140072db593258997f246798ace3ac4c61beffb9c3271157da4e006d8588222ce384026f4cd27c531aef

memory/2376-939-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/2376-938-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

110s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (624) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\ProgramData\F02D.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\F02D.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\F02D.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP0mf1x1vjc3p72fr0v963zp3bb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPeeyaz3chgpfp3zv18_meiv1v.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPq0qxh5z8lw7gif4lxrlh_wgd.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ZImkTWSLZ.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ZImkTWSLZ.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\F02D.tmp N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\F02D.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ZImkTWSLZ\ = "ZImkTWSLZ" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZImkTWSLZ\DefaultIcon C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZImkTWSLZ C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZImkTWSLZ\DefaultIcon\ = "C:\\ProgramData\\ZImkTWSLZ.ico" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ZImkTWSLZ C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe C:\Windows\splwow64.exe
PID 2896 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe C:\Windows\splwow64.exe
PID 4068 wrote to memory of 964 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4068 wrote to memory of 964 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2896 wrote to memory of 5204 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe C:\ProgramData\F02D.tmp
PID 2896 wrote to memory of 5204 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe C:\ProgramData\F02D.tmp
PID 2896 wrote to memory of 5204 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe C:\ProgramData\F02D.tmp
PID 2896 wrote to memory of 5204 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe C:\ProgramData\F02D.tmp
PID 5204 wrote to memory of 5384 N/A C:\ProgramData\F02D.tmp C:\Windows\SysWOW64\cmd.exe
PID 5204 wrote to memory of 5384 N/A C:\ProgramData\F02D.tmp C:\Windows\SysWOW64\cmd.exe
PID 5204 wrote to memory of 5384 N/A C:\ProgramData\F02D.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3F637B2A-FA09-4CD2-957E-250E44D074CE}.xps" 133771179100330000

C:\ProgramData\F02D.tmp

"C:\ProgramData\F02D.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F02D.tmp >> NUL

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ZImkTWSLZ.README.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 169.253.116.51.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/2896-0-0x0000000000F50000-0x0000000000F60000-memory.dmp

memory/2896-2-0x0000000000F50000-0x0000000000F60000-memory.dmp

memory/2896-1-0x0000000000F50000-0x0000000000F60000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\OOOOOOOOOOO

MD5 1d5641bbed653d8a453344a311524d58
SHA1 b5f911e3a3b52415bdf7455864db93f07bf21813
SHA256 e6c8720a251b9c1e326bf79381e62520c99b333a2f98adaa44a09c3fbe81e3e2
SHA512 ac2eab28648cb4a8f50ef6fcc6c6ef7cc8edb9b889534f3f7d3eb919d9a00dfed1fafdad1236c82cea623741069a2fa7617ddc35917f15c6d72df56504379e4b

F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\DDDDDDDDDDD

MD5 369561af548d91ef8fd370fbb092c13d
SHA1 486222e5c3b581276f51903b4836eeb4783cc5b6
SHA256 50209a433e4c9e21dc143f8f115a27827a8b6a66ab6cd9824981d3bc7c4cffbf
SHA512 d700aaa534651550626dbd1486f46242db0b2188d4003f8747f4806708e8169ff4fc9fde9c6d01821e259b0127ce50dfa15615cb2d4488db7c4a7a65a18c093b

C:\ZImkTWSLZ.README.txt

MD5 ac0a72561be286c96ed6a9f1c968a9a7
SHA1 70b5a6beae64a6d700b289802363770c97cb7be8
SHA256 1d99f379400fc1034c25515fea96ac07539a9db38dd377e924c3d0a34814803e
SHA512 c40b22cd97fa49ee9eb8493feee1690ee33773947b23535e5bea444334f9a753e6531bf6e1ccaefa9abe8a04da7e8319bcc6314eb2c609414a602c9ea1fe09b3

memory/2896-2977-0x0000000000F50000-0x0000000000F60000-memory.dmp

memory/2896-2979-0x0000000000F50000-0x0000000000F60000-memory.dmp

memory/2896-2978-0x0000000000F50000-0x0000000000F60000-memory.dmp

C:\ProgramData\F02D.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/964-2995-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

memory/964-2996-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

memory/964-2998-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

memory/964-2999-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

memory/964-2997-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\DDDDDDD

MD5 9d71043997c8ec1a2e280eae416aed0d
SHA1 f0a349a0d53da4bcc94a13539bb8801fe27c4f0e
SHA256 f2437a96e8e4c4d2fd422aaf6522a56fff10540f806dd1fd423cfde666bc7ff4
SHA512 98513f34b59094def291ded825db867af710dcc22d409957a8ce8da2c202a0b1b7a4dc5066b0db6d590e3a5e55927281318ac078ed092dcd684bcf6d3a7055a0

memory/964-3028-0x00007FFECA190000-0x00007FFECA1A0000-memory.dmp

memory/964-3029-0x00007FFECA190000-0x00007FFECA1A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{1F5E15EA-DC4B-4924-9112-EEECBAF0FB55}

MD5 54f43cfc0bc6a5ab4c8df3c6d3462b70
SHA1 be7550055ff19b602b6378438dd70463091344bf
SHA256 577e86c976c1cec4290e01bd61e2baa29ec336a1bd271e178244dd862c5f7432
SHA512 6fb2f99495841f418496a6b0246f814cca0eb8fc61d67cd5e1a56d46ef07309730d01bc6c159c82122080d7f98614a3526db9a38a52159f1b844debfda8db2cd

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 0f063f48718a7b4bd6e4f4b780598266
SHA1 2b27331d978460d75190b94aa8cd7ca761954801
SHA256 0f666fa52b2bc4a0ca1176f4d727ae805418bb6bdf27dd9ace259744ce7bd8f5
SHA512 c82300bc9e8a1855f634e12bf21df942b7e71f7517bb254e729f5c41cd686d52ce0ac843c7fc513a5f84ce58d9f213110e57d03b08b3b3a3f500fc396202fe8f

memory/964-3067-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

memory/964-3068-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

memory/964-3070-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

memory/964-3069-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\Build\LB3Decryptor.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit30\builder.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 103.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-26 18:04

Reported

2024-11-26 18:07

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe"

Signatures

Lockbit

ransomware lockbit

Lockbit family

lockbit

Renames multiple (629) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\ProgramData\CAE.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\CAE.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\CAE.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PP5in91lfeynlnl1ghljzqcrgic.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPh066787ykgv1u72vova5w75t.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPlblqnu612khida759o204a2ob.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\HHuYRxB06.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\HHuYRxB06.bmp" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\CAE.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.HHuYRxB06 C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.HHuYRxB06\ = "HHuYRxB06" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHuYRxB06\DefaultIcon C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HHuYRxB06 C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HHuYRxB06\DefaultIcon\ = "C:\\ProgramData\\HHuYRxB06.ico" C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1148 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe C:\Windows\splwow64.exe
PID 1148 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe C:\Windows\splwow64.exe
PID 4448 wrote to memory of 4004 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 4448 wrote to memory of 4004 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 1148 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe C:\ProgramData\CAE.tmp
PID 1148 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe C:\ProgramData\CAE.tmp
PID 1148 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe C:\ProgramData\CAE.tmp
PID 1148 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe C:\ProgramData\CAE.tmp
PID 4784 wrote to memory of 1784 N/A C:\ProgramData\CAE.tmp C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 1784 N/A C:\ProgramData\CAE.tmp C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 1784 N/A C:\ProgramData\CAE.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe

"C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C7985D49-38DC-4407-8A20-750A91B9831E}.xps" 133771179121590000

C:\ProgramData\CAE.tmp

"C:\ProgramData\CAE.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CAE.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 19.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1148-1-0x0000000002D60000-0x0000000002D70000-memory.dmp

memory/1148-0-0x0000000002D60000-0x0000000002D70000-memory.dmp

memory/1148-2-0x0000000002D60000-0x0000000002D70000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\FFFFFFFFFFF

MD5 b1d67c38373130c0642173b5ec3e5a94
SHA1 6207d0670f036cd78398beed7ed2347eee6e05fb
SHA256 2a24194245054b6dfe97b47ce05b5e057d998f8f00418f6e70356ef7c7acd67b
SHA512 19a631e1f8f63f3de1735898e5f76231a5ebfab682510d3cb57b7b0afc8a97eb34132763ad19d079845fbabf81b76b4f1cd9bd4178139fe80692acee285c21be

F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\DDDDDDDDDDD

MD5 8c883f2af0fcd79411c4e3c22ddbc16e
SHA1 702aa424add1a666d16e9740e48585cbb36b6028
SHA256 90f40f8e232e1e9310a3bb759ded03fe57de30f69478e945f021b4275bd5f3f9
SHA512 b68a0c6f6f80a590f54f60a21eed825a1cf0cf49793173f70d2df58e015e2f9d569f7a0d296816443585ff01f2e48fc6c25fca36a2c1324772a6c32e0e13c858

C:\HHuYRxB06.README.txt

MD5 33fceacc223b740870349c6ff47cca88
SHA1 93aa29c1a0d5d99f061f1465da36dcf583f9fb8f
SHA256 ef18b7d754a2992e7aba3e9715bc2c96850eefe7ea4ca0d657d93443b326191e
SHA512 1e86532590a04454899b013eb7bcd6651805ce22f8fae67040c067eec55e69d558bf5c65c9f9deb40d4ba105348ef21177bbde60b8b340d14c5a58d13b344e43

memory/1148-3021-0x0000000002D60000-0x0000000002D70000-memory.dmp

memory/1148-3022-0x0000000002D60000-0x0000000002D70000-memory.dmp

memory/1148-3023-0x0000000002D60000-0x0000000002D70000-memory.dmp

C:\ProgramData\CAE.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4004-3040-0x00007FFC2F330000-0x00007FFC2F340000-memory.dmp

memory/4004-3041-0x00007FFC2F330000-0x00007FFC2F340000-memory.dmp

memory/4004-3043-0x00007FFC2F330000-0x00007FFC2F340000-memory.dmp

memory/4004-3042-0x00007FFC2F330000-0x00007FFC2F340000-memory.dmp

memory/4004-3038-0x00007FFC2F330000-0x00007FFC2F340000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit3Builder\Build\EEEEEEE

MD5 e36db911cc61a78078c755303575a356
SHA1 0e9bd6949385fc40f75a35fdedce7d4e3ab1039f
SHA256 4fbcfe35da6547097bb2266d4ac679a5d40e408b4099eb41f680eed42aa9604f
SHA512 d18e16c1e111c1294d551510542d19cd89749200ca0b18b30ca7f3f7400bd818d42d095acb3bbd03e26a1f16039673cd05374b2bfdc0dde73aa2772d9e5851db

memory/4004-3072-0x00007FFC2D1D0000-0x00007FFC2D1E0000-memory.dmp

memory/4004-3073-0x00007FFC2D1D0000-0x00007FFC2D1E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{B74AB988-5CEE-4B81-A305-06FB4BBA27D4}

MD5 c4a1724795e4fb35d1a9ee04741406f2
SHA1 37621266d63cc18d9a8606cc4cf6a78a682dfa1c
SHA256 dd639e6dfad7bab7dbc2ce6b5ccda4a99e657533f5689cf460a0b9519a7ee415
SHA512 a9224b19bb2b3a28e890c55ce182f8d2315bec50d53c2aa7fa89f5c3f392c92a81f8fe8b827b797e65374da8ef8adaa92f306ef65e84cb97c753401f9ac9565d

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 1457db4a844151a8fecdb9202ccfa06d
SHA1 fe19f06300027666faea276d202548424ea709a0
SHA256 4c3c1a1a717d9f978d3b1a1d637902b8b03627064c29aa12ab6dc7a854693711
SHA512 4fb78b628d1a1b9f040807e07ea64a1b05e0dded50e28d838769a8a211e6a29e77b19a66521451440510ba2a4b0c541b4df5a2bd37eabafb4e6801dcf615879c