Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/06/2026, 18:31
Behavioral task
behavioral1
Sample
lb18.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
lb18.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target lb18.exe
- Size 146KB
- Sample260617-w58bfset61
- SHA256 fa361c712381c82552952e348c36dca949329db6ea6088c7228c3884ebb0bfe7
- MD5 b72d50ea8dc21d86430efdcba9646d39
- SHA1 c3927aaa94c768095fe983d5b46876fa080dca02
- SHA512 53fedfaea2231f5bb3c497e39f36caa83522fbffb0e6e7be11d5ce118679c624622c849326cf67b32ef7ed28307f59bde1514e70b45d583d1a027210442608b8
- SSDEEP 3072:O6glyuxE4GsUPnliByocWepu7JFibU4BQu:O6gDBGpvEByocWeM7JFio4W
- TLSH T1B8E37E21F212D0B3C87718F1273675B2F39E4D2C199A6857EAE80F9DBC648232F54997
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (1077) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation FCFA.tmp - Deletes itself 1 IoCs
pid Process 6428 FCFA.tmp - Executes dropped EXE 1 IoCs
pid Process 6428 FCFA.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\desktop.ini lb18.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1074038928-2032447174-945360078-1000\desktop.ini lb18.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: lb18.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPw00pc00etxiun950duuokvt6d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPjktg8lz5dizp0e5ysp32dtrgb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPwtxfoytx6e_500t8jrfv3j0t.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\2KVf9Kil2.bmp" lb18.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\2KVf9Kil2.bmp" lb18.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 6428 FCFA.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lb18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop lb18.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "10" lb18.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.2KVf9Kil2 lb18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.2KVf9Kil2\ = "2KVf9Kil2" lb18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2KVf9Kil2\DefaultIcon lb18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2KVf9Kil2 lb18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\2KVf9Kil2\DefaultIcon\ = "C:\\ProgramData\\2KVf9Kil2.ico" lb18.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe 1820 lb18.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp 6428 FCFA.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeDebugPrivilege 1820 lb18.exe Token: 36 1820 lb18.exe Token: SeImpersonatePrivilege 1820 lb18.exe Token: SeIncBasePriorityPrivilege 1820 lb18.exe Token: SeIncreaseQuotaPrivilege 1820 lb18.exe Token: 33 1820 lb18.exe Token: SeManageVolumePrivilege 1820 lb18.exe Token: SeProfSingleProcessPrivilege 1820 lb18.exe Token: SeRestorePrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSystemProfilePrivilege 1820 lb18.exe Token: SeTakeOwnershipPrivilege 1820 lb18.exe Token: SeShutdownPrivilege 1820 lb18.exe Token: SeDebugPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeBackupPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe Token: SeSecurityPrivilege 1820 lb18.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE 6488 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1820 wrote to memory of 5352 1820 lb18.exe 95 PID 6140 wrote to memory of 6488 6140 printfilterpipelinesvc.exe 104 PID 1820 wrote to memory of 6428 1820 lb18.exe 105 PID 1820 wrote to memory of 6428 1820 lb18.exe 105 PID 6428 wrote to memory of 6624 6428 FCFA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\lb18.exe"C:\Users\Admin\AppData\Local\Temp\lb18.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:5352
-
-
C:\ProgramData\FCFA.tmp"C:\ProgramData\FCFA.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6428 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FCFA.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:6624
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5412
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{A7140C9B-D063-4F14-A495-D0DFB5141777}.xps" 1342619469729600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:6488
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\BBBBBBBBBBB
- Size 129B
- SHA256 47064fdefb06bc87f26ff9df92c571a4d0e610915afff3d7db095e6b559a467d
- MD5 9a8e5d25a110941f4ba2903b95403187
- SHA1 5e034b84db8b8219cd17bdbd3cd4ffebeff92172
- SHA512 7fbdc76d300e5f9cdf6d2668f5e38ba0218db9bd39ed5a067ddc8d9ccf03816ea1c6f4c00f18bc7aa7cf01f750739ee3df0323661860e72fb6078c56cb4f5a53
- TLSH T1CEB02B33D501142A9708A0AC003B63701C13A00E1325E00004D0547495EF1000447E84
- MD5 SHA1 SHA512 TLSH
- Path C:\2KVf9Kil2.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\FCFA.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDD
- Size 146KB
- SHA256 c08374e4a047198a9b495078b51f03629766db2746c277d533fed5ef54879e19
- MD5 716929786d4f4c02f233603498ebd62e
- SHA1 7aa8c6357eb90ec8a2874b3bf006c076768baf7e
- SHA512 96028b446788b479528ac661b26039ddfbeb84f05eb25ff4d32b6e2f4e3a40cd6a3f8cdc8a95852ee8cef96aa79115782dbbcde722b7f0ed823318b50bfca1bd
- SSDEEP 3072:aIS8HmetJsZh9mYt3mY8JIS8HmetJsZh9mYt3mY8JIS8HmD:aJ8Hmetk1t+J8Hmetk1t+J8HmD
- TLSH T189E3021609E530C33DE1F568738B2D258D1B26D31B8E1D296C7C215AEFA44A1F963BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{E1B41373-6328-42E3-ACA9-1038051298C3}
- Size 4KB
- SHA256 70930faaa2bf156ebff01fb7631b5798c744ff4686fab027c54fcf54051d1fc2
- MD5 a19b0f9f768b7bb65cc0a045192b4d85
- SHA1 f67f319de7dc18658c51a5b5d10747b4efaf3a2a
- SHA512 b9a199f0104e162b1051cb875260b652cafdea1eda61a1f047d25faf484ebdd3e55741f17f606e5028669decb1413393e83e847f8c2526d8365d91905094d7dc
- SSDEEP 6:RakjGwi/gYyfB3h1RRXUnfbvQlmq1VFKdycpZLHcuRujlw//0lweI/ILHcyRujd:RaQYyf9/UfEZwyuZQWf/4I
- TLSH T1F4A14F89F74BC095D2A8497D5D97CADDEA95BD89ACA705433EC8B31D0D32E808B42262
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 8b6fc5adbe76c2afacea04b6bd8dce6c4adfa5e01301d3ca678a1ec30f2bdb1a
- MD5 be6dd850ef29efe19dda90e5026827a1
- SHA1 b4a4f6323834dd101c5e92a9c36c4a590d06c485
- SHA512 24ba9084ae6560cab79773680e5d7d0c6866e108edec2efc5b0d74a039228c61d6fbef9f577f004c6425212866e8825a830099d6236d39560f78e23aae65b078
- SSDEEP 12:RaQYyfHj/UvH4/lRwyuZQW6/49guCX6pLItEIxA/L:YQYyfHYSRwxuoXiCkt1Aj
- TLSH T140A12885FB0AD058C2A89A781D87CBADEB51FD45ACBB06133AD4732D0E36E805B41221
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-1074038928-2032447174-945360078-1000\DDDDDDDDDDD
- Size 129B
- SHA256 4e5502ef2f3a0db661984b9e03c79faf86b5b03047b998c3b35063c319b83dd3
- MD5 9e5a9b07a188a48f95d84287f1e86c47
- SHA1 f6a6e5f1b43de008687402c119d570d4bbec90c1
- SHA512 ee02bdf1ebf6d043b7bebb3f715d6a39d26cea69c5161f3958dca4dcfce9eed44fdae581e9918c07f02fde9e3996ace5b9d4df71119fd54115b475d4f11c5f9a
- TLSH T101B02B26F678410B40004E413CC8D64700008F2F1060CD00030C405B421A2AC80C04FD
- MD5 SHA1 SHA512 TLSH