lockbit | e1275c80d30a307899029cf13e3a190df717c3b7e68877e03650cebc07e418cf

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LB3.exe
Size

153KB
MD5

194a2b32336037e01cee90666d88612e
SHA1

19bbb1fd707c9656e3781a78b0780f639395044a
SHA256

e1275c80d30a307899029cf13e3a190df717c3b7e68877e03650cebc07e418cf
SHA512

8656d21e2705967d310d19d9e2471f127138a1e709bf8c84d21096d5affdead0eab389c4cb7c4a1b0a249205cfa717ffe108725e00fc8cb192c6f36687ae2efd
SSDEEP

3072:x6glyuxE4GsUPnliByocWepwamici0p1zj/:x6gDBGpvEByocWehm3xD

Score

10^/10

lockbit defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Ox7PjiunT.README.txt

Family

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 212B91E70517EDCA036BC44E27C4DE23 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Emails

[email protected]

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

http://lockbitapt.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

Signatures

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Lockbit family
lockbit
Renames multiple (639) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	BB13.tmp

Deletes itself 1 IoCs

pid	Process
2088	BB13.tmp

Executes dropped EXE 1 IoCs

pid	Process
2088	BB13.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini	LB3.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini	LB3.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\PP10tg_833ctwylo66fsnqbkdlb.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PP8018g9uu67iugm2qgsivh80w.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPa7mo_zyaaxs_wo9ud862a_kbb.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Ox7PjiunT.bmp"	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Ox7PjiunT.bmp"	LB3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
2088	BB13.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LB3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BB13.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop	LB3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperStyle = "10"	LB3.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ox7PjiunT\DefaultIcon\ = "C:\\ProgramData\\Ox7PjiunT.ico"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Ox7PjiunT	LB3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Ox7PjiunT\ = "Ox7PjiunT"	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ox7PjiunT\DefaultIcon	LB3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ox7PjiunT	LB3.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1924	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3948	ONENOTE.EXE
3948	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe
5100	LB3.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp
2088	BB13.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeDebugPrivilege	5100	LB3.exe
Token: 36	5100	LB3.exe
Token: SeImpersonatePrivilege	5100	LB3.exe
Token: SeIncBasePriorityPrivilege	5100	LB3.exe
Token: SeIncreaseQuotaPrivilege	5100	LB3.exe
Token: 33	5100	LB3.exe
Token: SeManageVolumePrivilege	5100	LB3.exe
Token: SeProfSingleProcessPrivilege	5100	LB3.exe
Token: SeRestorePrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSystemProfilePrivilege	5100	LB3.exe
Token: SeTakeOwnershipPrivilege	5100	LB3.exe
Token: SeShutdownPrivilege	5100	LB3.exe
Token: SeDebugPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeBackupPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe
Token: SeSecurityPrivilege	5100	LB3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE
3948	ONENOTE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 412	5100	LB3.exe	88
PID 5100 wrote to memory of 412	5100	LB3.exe	88
PID 5460 wrote to memory of 3948	5460	printfilterpipelinesvc.exe	91
PID 5460 wrote to memory of 3948	5460	printfilterpipelinesvc.exe	91
PID 5100 wrote to memory of 2088	5100	LB3.exe	92
PID 5100 wrote to memory of 2088	5100	LB3.exe	92
PID 5100 wrote to memory of 2088	5100	LB3.exe	92
PID 5100 wrote to memory of 2088	5100	LB3.exe	92
PID 2088 wrote to memory of 3044	2088	BB13.tmp	93
PID 2088 wrote to memory of 3044	2088	BB13.tmp	93
PID 2088 wrote to memory of 3044	2088	BB13.tmp	93

C:\Users\Admin\AppData\Local\Temp\LB3.exe
"C:\Users\Admin\AppData\Local\Temp\LB3.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:412
- C:\ProgramData\BB13.tmp
  "C:\ProgramData\BB13.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BB13.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3044

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Ox7PjiunT.README.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2868

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{446DE03A-4622-4F02-82A7-3AAAB3961CEF}.xps" 133795253147980000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\CCCCCCCCCCC

Filesize
129B

MD5
5f58bfc2dce46f8f6a621aa149d4396b

SHA1
4268922d9ceaab675c3adce148cb1fa46d60df1e

SHA256
6bfaea37022ecc46fc6a48058ed0216049d4144a3b6f49553cc49099c00ffafe

SHA512
1df9080551b8d575fd1e913210a2a3898fbc52d7d370f72fc9e6fd4d45a6beb9b06c15f3f392565d9c427062c560fe57658eb5cb2273601d636d2ddc4c335b2c

Download Submit
C:\Ox7PjiunT.README.txt

Filesize
6KB

MD5
52e4e88745a7d04a51006b56d29aee85

SHA1
fbafb402bb60255b50702ba34222a4c45847cf7f

SHA256
1ce29fb6042b13ca7d444c8e4be921dd717287e009fc5887e94afabf61950e4f

SHA512
a83a52a37057c584385b789059d0a057a5e7cfb32587059798874bcda2dc50442addd48dbe6ea459ed9634ce4a1a05f2fdcdd1198b96350ddb44421a25a7caa0

Download Submit
C:\ProgramData\BB13.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDD

Filesize
153KB

MD5
23bf4cb50d443172c0395c0e6f3dcebc

SHA1
e58406ccd4421aa605f6a844a25b04ad67de1b4c

SHA256
6f2b11321c4b68381fd172bce4e51afbc34a9f43f3360152db46cb1605f768eb

SHA512
7d5d133e2542761ebc24270994ccedd565afdb6f00d48cf424fe41ab9ee2346dad46aca7febb4e3ad63b52d79d2768101bc1dff88c3a9541119c5aea8a2e2553

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B6AFC77F-E3E2-4D71-9A5C-EAB6128F14BC}

Filesize
4KB

MD5
e6e56da9bdf0f62091307bc7c8769a7d

SHA1
f982c16707a236338681f468279608a80b9c15af

SHA256
38965ad0bd47851ada3969980bef31eb68ec46715fe946ba88ed3b400af00e11

SHA512
ebadb445080dc66a003aa56770bcef54e4ec381424cd0db378ecd8824ee01f5e436bbb377474d3012d4047c9ccfd9a0ba072d101c068bac35bd7649c6e648a6b

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

Filesize
4KB

MD5
3cfbb6191e6f62e0888e7d0bbb2bc63b

SHA1
56eb24ecf7dc08d0a139e9653f512e0e8d3b5c6c

SHA256
eaa70924fe0ce0fb88433eafed2f854e0cb26103e404e065decfa15b431699ae

SHA512
e09a56c643c1e171fcc727b61eeff75a726fe4e47d22fd7147b1c6fb124bd495b44ae561600033e87292262bed7e67d69ec72a13fae6fa344638563da4accf33

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\DDDDDDDDDDD

Filesize
129B

MD5
dd9d78d35ec946eb1907b7c1c2f9aadc

SHA1
8dace116529019811aec54951da6c2efe5caecc1

SHA256
8b82f228ae15e44b5ac12eb66b1e59c7a8d38f0d581a9a89ce20ac3c1f5cf8ac

SHA512
883c736bda222180e60da5637c11454a5601a189758c65ab74b0d388e69dbb80d124ddbaac5ba8c2d4b08ded3e170f3e621fc1bfa95b38d103cccf4aaa8584fe

Download Submit
memory/3948-2904-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2978-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2903-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2902-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2901-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2979-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2905-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2980-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2977-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Filesize
64KB

Download
memory/3948-2938-0x00007FFCA2FF0000-0x00007FFCA3000000-memory.dmp

Filesize
64KB

Download
memory/3948-2939-0x00007FFCA2FF0000-0x00007FFCA3000000-memory.dmp

Filesize
64KB

Download
memory/5100-2-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/5100-1-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/5100-2889-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/5100-2887-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/5100-2888-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/5100-0-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download