Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/06/2026, 18:31
Behavioral task
behavioral1
Sample
lb18.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
lb18.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target lb18.exe
- Size 146KB
- Sample260617-w58bfset61
- SHA256 fa361c712381c82552952e348c36dca949329db6ea6088c7228c3884ebb0bfe7
- MD5 b72d50ea8dc21d86430efdcba9646d39
- SHA1 c3927aaa94c768095fe983d5b46876fa080dca02
- SHA512 53fedfaea2231f5bb3c497e39f36caa83522fbffb0e6e7be11d5ce118679c624622c849326cf67b32ef7ed28307f59bde1514e70b45d583d1a027210442608b8
- SSDEEP 3072:O6glyuxE4GsUPnliByocWepu7JFibU4BQu:O6gDBGpvEByocWeM7JFio4W
- TLSH T1B8E37E21F212D0B3C87718F1273675B2F39E4D2C199A6857EAE80F9DBC648232F54997
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Renames multiple (768) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 2512 2DB3.tmp - Executes dropped EXE 1 IoCs
pid Process 2512 2DB3.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2654269261-3199571979-4291878722-1000\desktop.ini lb18.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2654269261-3199571979-4291878722-1000\desktop.ini lb18.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: lb18.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP903p0h3qvb02gsgo69fjn32md.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPpu08wq7iewwfjizztmjona16d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPwp8y10z_q9ah4wlojolgpc5l.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\2KVf9Kil2.bmp" lb18.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\2KVf9Kil2.bmp" lb18.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 2512 2DB3.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lb18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop lb18.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\WallpaperStyle = "10" lb18.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\2KVf9Kil2\DefaultIcon\ = "C:\\ProgramData\\2KVf9Kil2.ico" lb18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.2KVf9Kil2 lb18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.2KVf9Kil2\ = "2KVf9Kil2" lb18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2KVf9Kil2\DefaultIcon lb18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2KVf9Kil2 lb18.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 3092 lb18.exe 5140 ONENOTE.EXE 5140 ONENOTE.EXE - Suspicious behavior: RenamesItself 26 IoCs
pid Process 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp 2512 2DB3.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeDebugPrivilege 3092 lb18.exe Token: 36 3092 lb18.exe Token: SeImpersonatePrivilege 3092 lb18.exe Token: SeIncBasePriorityPrivilege 3092 lb18.exe Token: SeIncreaseQuotaPrivilege 3092 lb18.exe Token: 33 3092 lb18.exe Token: SeManageVolumePrivilege 3092 lb18.exe Token: SeProfSingleProcessPrivilege 3092 lb18.exe Token: SeRestorePrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSystemProfilePrivilege 3092 lb18.exe Token: SeTakeOwnershipPrivilege 3092 lb18.exe Token: SeShutdownPrivilege 3092 lb18.exe Token: SeDebugPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeBackupPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe Token: SeSecurityPrivilege 3092 lb18.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE 5140 ONENOTE.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3092 wrote to memory of 1196 3092 lb18.exe 83 PID 1748 wrote to memory of 5140 1748 printfilterpipelinesvc.exe 86 PID 3092 wrote to memory of 2512 3092 lb18.exe 87 PID 3092 wrote to memory of 2512 3092 lb18.exe 87 PID 2512 wrote to memory of 5180 2512 2DB3.tmp 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\lb18.exe"C:\Users\Admin\AppData\Local\Temp\lb18.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1196
-
-
C:\ProgramData\2DB3.tmp"C:\ProgramData\2DB3.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2DB3.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:5180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4920
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{821C4E11-1BBF-4743-AB48-D071FD6F0FD0}.xps" 1342619469577100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5140
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2654269261-3199571979-4291878722-1000\YYYYYYYYYYY
- Size 129B
- SHA256 784f85ef7e9e7d3402130261fd259459b356cc166a6ef5a01986dd696623090a
- MD5 4d2c4791dde590e71117a2bcac22a170
- SHA1 82a2f8a520a6b87a9940e946ae1b7abe91eabfae
- SHA512 aab1e01bcafcc82182f780bf3df49b892ca6cca5af55a24cc55e3d11fb0363e31c5f2a4a0c96f957d9d4d2edb9fe4c2780ab9ff8720bb3b3cd6c853b13c1d2c4
- TLSH T1ECB02B230870DDD53A6020D008300021910D0B02CF88E18F54010D0B2F28C4F682E5BC
- MD5 SHA1 SHA512 TLSH
- Path C:\2KVf9Kil2.README.txt
- Size 427B
- SHA256 29a544b27712da1f10bbf00378e7ccfd0ba5fdef465e221512cb9733ed31ff60
- MD5 e46429c9288ce455fcf5e80ecd99d2c8
- SHA1 76948e570ec0a492bbc71e5485d8fa744c846796
- SHA512 a4ef30a36f60e4788cdb26aaaecf3115ed44ff01d19773e3f2652e7817a85a5732c76806484460095550395db95ff29a6024d998fe7b9a14ec06c0897bde5455
- TLSH T170E0F19C61BF95C447120295393CDDB50669F112CAB8A4C6B8C124FB2FA9EF48360DAF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\2DB3.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- TLSH T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDD
- Size 146KB
- SHA256 07fe9722f11e91f6d801b8cd7f28675a2d4e1585bfe0bb6bc9f05ed95abc04f9
- MD5 fbc77040f2fffd6c19676bb4b6875a4c
- SHA1 f34adeec9241e7dc090cb0c7f04c45e362b3347d
- SHA512 757fd7baa4c66bf1b599ae23af5e271ff4ba8a8ae290c491197051121a22af4a65d3acd0ed1def87143e0a1eeb00ebe662f6a4b9c717d473656928610e13520b
- SSDEEP 3072:wi0IlnnzcBcyxwko1+lvhrCFi0IlnnzcBcyxwko1+lvhrCFi0IlI:wZzBcyyV+h9CFZzBcyyV+h9CFZ9
- TLSH T13DE3027237326738288E86CEAA4752D28A051D5ED03F0F98F15B5B93CBBD7358263497
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{2627D58B-F95C-4898-98B2-651F1C41E1CB}
- Size 4KB
- SHA256 ac11f4f5f8611246a312e24d2bf3fbe8c54331ca84c467d25db09a9e28e5372e
- MD5 6c2072fb9d8172181a0e1c9e301468e9
- SHA1 6c984123d4876e0c8a47c1a8c4160f4134686ab0
- SHA512 4ee132fa9330c7195a2bbd6cb45ef5828f3d74cf301342683580dd73054f79bbe98ba4a9312f5ee82e84fcdb60928744bb7ad05ca3923b89a40fc1a97d3a4207
- SSDEEP 6:Rado3YyfB3h1RRXUnfkzJg1KtsS/dFKV4H4bRujlw//0lweI/8g4BRujd:Ra63Yyf9/UfktgKv/jWf/7
- TLSH T1A4A18694B748E0AFD1A05B3D1D57CBDE8EC27D9D8C0117637EED730D1832E809411292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 4b878e8bac0cfe90317f6fd120750436ae35f654f8cd217de6a10eeb6b82ccc1
- MD5 42b34322220d6c53d5cde429cab1b7b9
- SHA1 de00ce121807bbd944fd8b51c024a905c3b6c8cc
- SHA512 89526be1ad5bfcb5060cdc147b070683fcc59b374422ab04265a19ab1b51d2e404b34705c2ec0f0765dbf0e0b466bc3f625944eb66a1e09bb23e3054d6f887f9
- SSDEEP 6:Rado3YyfBxh1RRXUnvl/KtsS/dFKV4H4bRujlw//0lwepVV4lYt/8g4U6lRRuj+l:Ra63YyfHj/UvtKv/jW6/IZuv93EIxA/L
- TLSH T1EAA1C295B718F09ED1A0AB782D47CBED9B91BD1A9C1117177AE4731D0C36A808920651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-2654269261-3199571979-4291878722-1000\DDDDDDDDDDD
- Size 129B
- SHA256 210d820963fa7b004cf5e3ed57a0163c61eec1560cac42b5df44da271fa736ec
- MD5 880e7b54c37e308e1d186c4a312e8545
- SHA1 747e73d4be2027434baf1f34fba4878fa5f8c37b
- SHA512 7b211e43238955080e0496422e1699f2ba87108a52c513eb7fed80870d17bcc7c356dd15de4dd5423adfd8e29898937b208054e1e287744d3f184cd4ee846ac0
- TLSH T1D3B02B53C344B8F8D36C0443DE01F14C040004302045CA4543376C2056201C2C43184D
- MD5 SHA1 SHA512 TLSH