3968a850f5bc70d954bb5609d929f181a6f05a117fa3be4531cbd96cedfde5d6

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LBB.exe
Size

160KB
MD5

d1986caa455ffa11b46341e837777e52
SHA1

c045c2be676ebba04d7403f3636c7adb685a4011
SHA256

e2bda5afc3e70460223a98cd3520e4ab97fd126a48b9fe7d385e1e9730a11407
SHA512

ea87e4f31a45a4e54c56dc120ce26c369a02af952d0c20411677c4cba4eb442a43b776d094150458a0b72dc65b53ca29fc300739cc56f81c6f7fee5e15043359
SSDEEP

3072:gDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368Pu7YlTx6gIB8FrN75DyW:K5d/zugZqll3AYrG+

Score

9^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Renames multiple (149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	C052.tmp

Deletes itself 1 IoCs

pid	Process
436	C052.tmp

Executes dropped EXE 1 IoCs

pid	Process
436	C052.tmp

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini	LBB.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini	LBB.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\kF0wnCN24.bmp"	LBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\kF0wnCN24.bmp"	LBB.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C052.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop	LBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\WallpaperStyle = "10"	LBB.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon	LBB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24	LBB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\kF0wnCN24\DefaultIcon\ = "C:\\ProgramData\\kF0wnCN24.ico"	LBB.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24	LBB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kF0wnCN24\ = "kF0wnCN24"	LBB.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe
4560	LBB.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp
436	C052.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeDebugPrivilege	4560	LBB.exe
Token: 36	4560	LBB.exe
Token: SeImpersonatePrivilege	4560	LBB.exe
Token: SeIncBasePriorityPrivilege	4560	LBB.exe
Token: SeIncreaseQuotaPrivilege	4560	LBB.exe
Token: 33	4560	LBB.exe
Token: SeManageVolumePrivilege	4560	LBB.exe
Token: SeProfSingleProcessPrivilege	4560	LBB.exe
Token: SeRestorePrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSystemProfilePrivilege	4560	LBB.exe
Token: SeTakeOwnershipPrivilege	4560	LBB.exe
Token: SeShutdownPrivilege	4560	LBB.exe
Token: SeDebugPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	1732	vssvc.exe
Token: SeRestorePrivilege	1732	vssvc.exe
Token: SeAuditPrivilege	1732	vssvc.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeSecurityPrivilege	4560	LBB.exe
Token: SeBackupPrivilege	4560	LBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 436	4560	LBB.exe	88
PID 4560 wrote to memory of 436	4560	LBB.exe	88
PID 4560 wrote to memory of 436	4560	LBB.exe	88
PID 4560 wrote to memory of 436	4560	LBB.exe	88
PID 436 wrote to memory of 3448	436	C052.tmp	95
PID 436 wrote to memory of 3448	436	C052.tmp	95
PID 436 wrote to memory of 3448	436	C052.tmp	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LBB.exe
"C:\Users\Admin\AppData\Local\Temp\LBB.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\ProgramData\C052.tmp
  "C:\ProgramData\C052.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C052.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\DDDDDDDDDDD

Filesize
129B

MD5
244915cd2daa896bed9250593e4e3645

SHA1
ff17a6dc7795e8f58f041fee432a70ec1934349f

SHA256
6afab4e62021169295cc44e94b95536f099ebb3b5346546c0b81d03c5e678ab2

SHA512
0059a58dbbfa99aee6e73a57e59334551259bc5f7a6b5adc7df659d8aeb95d76ce2b8c22e3e362d9d705c80923c3fe4c23f443ba3d6eedd23b5844e8cc2c1fd1

Download Submit
C:\ProgramData\C052.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDD

Filesize
160KB

MD5
b54ea5042dd54d248fae61df854fc664

SHA1
477fabea1448bfb195232eb07dcbc3b583ca22a9

SHA256
43b1b7b4a70c928508353b26e030c5971a762e47f35b6c57e06d6ed7bd594af6

SHA512
7f6c486fce28e68f9980ec6657fdf14030b4bf30fa0a27dd0fcfdcba7534c354895c448268c77829bdc666a13fb0255a430d63f026d2d8d520a5d413225afd7e

Download Submit
C:\Users\kF0wnCN24.README.txt

Filesize
6KB

MD5
c0d28e74d7701653c1e52b819a5992b6

SHA1
3e49fb8a047a9f651049fb8b94c6de37b2b0d257

SHA256
3ec9f9b784066862c4e14e4a9219979874355b706a2aa11461caeed5cbf56ef7

SHA512
5460597978ab9218c26ecdefc5588d4b457d61f1498424638dd3cdaa0457d4d187acbd354352c44987534e4c876fe0a20955e2424ee6328098c25353aea407ca

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\DDDDDDDDDDD

Filesize
129B

MD5
bbc9d53ba457fe48d375dca067da3c20

SHA1
0817d4a6d77617b1a865331e8f6f717b2b81d173

SHA256
558405ece162f029512e80cfdabb19c15565a30438b8fb280d60bc2020fa17e3

SHA512
e845aaeaad3d889ec91678d60367a2c327682f551279d7d16891244b0e60a80cdff4ce28b46297eb470aa8290f0861c094e40be627df8fd6543c7d25bba646e7

Download Submit
memory/436-303-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/436-304-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/436-307-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

Filesize
4KB

Download
memory/436-306-0x000000007FE20000-0x000000007FE21000-memory.dmp

Filesize
4KB

Download
memory/436-305-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/436-338-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/436-337-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/436-341-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

Filesize
4KB

Download
memory/436-342-0x000000007FE00000-0x000000007FE01000-memory.dmp

Filesize
4KB

Download
memory/4560-0-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/4560-308-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/4560-2-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/4560-1-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download