Overview

overview

10

Static

static

70d06bd4e6...f3.exe

windows7_x64

10

70d06bd4e6...f3.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    70d06bd4e6a91b60bc8515e327fa1f9fb7ac82125e3c8a06359b5bb3f96e48f3.zip
  • Size 526KB
  • Sample201104-abn29rhmv2
  • SHA256 bcd71b477c94eddf46abc65caa9c0c7d3e487814efe8c6aa67e7e96ed8738ba6
  • MD5 SHA1 SHA512
Score
10/10
lockypersistenceransomware

Malware Config

Targets

    • Target
      70d06bd4e6a91b60bc8515e327fa1f9fb7ac82125e3c8a06359b5bb3f96e48f3
    • Size 594KB
    • SHA256 70d06bd4e6a91b60bc8515e327fa1f9fb7ac82125e3c8a06359b5bb3f96e48f3
    • MD5 SHA1 SHA512
    Score
    10/10
    lockypersistenceransomware

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Modifies service

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks