locky_lukitus | 87f7c04e91789574ed974c8374f57d55e0de18cf328cce1bba942431de1b50d7

General

Target

8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe
Size

617KB
MD5

d14bc9efe80aeb7d172cbb590f80eba7
SHA1

9d6ea38d9a33446488e3a53ca35669f7ded2b747
SHA256

8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285
SHA512

cb22f3c7d3f35cc4d149d88caf128229c396123997b52c2dfb70203cbb671f967c20bb1615ec84227d1207d50cacd32daf1360f076d42c50b113949074192b58

Score

10^/10

locky_lukitus ransomware

Malware Config

Signatures

Locky (Lukitus variant)
Variant of the Locky ransomware seen in the wild since late 2017.
ransomware locky_lukitus
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1844 cmd.exe

pid	process
1844	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\lukitus.bmp"	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\WallpaperStyle = "0"	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\TileWallpaper = "0"	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{154FC971-1F2F-11EB-8332-F65A7312C48E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07c77ea3bb3d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000091475e202a9fd4abea7cc6a74e7f5930a89b38153f1ac9c7497adc5ee3ad8355000000000e8000000002000020000000044cdf999fb39a1d9dedac899b6601b68d575683c4772cabec53caedf911deff20000000190d9539d0f397bb8c1e31eb9f7dee81525f35fa74da3e79b282060afcda276740000000657308d9d85abde56177e0e9e2fda614f539a7970047d04a51ea3dd13ef2ad1b991590c2a22a13cb97877ea27445643e22bafb74ff61e9ef4466b47751a928b1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000d5819d1d73e81f98aa68f756e2eca8ba045971e79570128c3521f2201806e504000000000e8000000002000020000000a7388bb94076332204ff29ec2e20b16dd099fbbeb27e08a1573201d04151797590000000402d06b875299fb02067553082753dbb507baa9af69e17ba30d4de0cc0e4f489ef324e81b8916046d1d4fbbfbc9ea600963d035a97aae4c1c987225fa280513042dd5284ca5229d9a50dec8e58e4098c96079939c1c49bc33ff394903a918c4513d9cb5519ca7d7e8ef82e8d9c5c145ccad3c3f1193e5bb903535a2154b27cdcd3ac625cec0a428ceb82fd04471138104000000043e17c8a33859001ff7c232ad25f9efcba8f5807f489fcc8f096d1f40373e2002844a70175eac701aedc51ea2e601c68976eee5a530b06001c8ad459cbce7b27	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

472 iexplore.exe
684 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

472 iexplore.exe
472 iexplore.exe
1612 IEXPLORE.EXE
1612 IEXPLORE.EXE

pid	process
472	iexplore.exe
684	DllHost.exe

pid	process
472	iexplore.exe
472	iexplore.exe
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exeiexplore.exe

description	pid	process	target process
PID 1892 wrote to memory of 472	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	iexplore.exe
PID 1892 wrote to memory of 472	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	iexplore.exe
PID 1892 wrote to memory of 472	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	iexplore.exe
PID 1892 wrote to memory of 472	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	iexplore.exe
PID 472 wrote to memory of 1612	472	iexplore.exe	IEXPLORE.EXE
PID 472 wrote to memory of 1612	472	iexplore.exe	IEXPLORE.EXE
PID 472 wrote to memory of 1612	472	iexplore.exe	IEXPLORE.EXE
PID 472 wrote to memory of 1612	472	iexplore.exe	IEXPLORE.EXE
PID 1892 wrote to memory of 1844	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	cmd.exe
PID 1892 wrote to memory of 1844	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	cmd.exe
PID 1892 wrote to memory of 1844	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	cmd.exe
PID 1892 wrote to memory of 1844	1892	8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe
"C:\Users\Admin\AppData\Local\Temp\8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\lukitus.htm
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:472 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\8514a2eca4090f400a43c4af915eb3ef6e9c15dabe69716189e7c68c72cfa285.exe"
  2⤵
  - Deletes itself
  PID:1844

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\lukitus.bmp

MD5
c6bd8b26ebf800f9396253838e67f533

SHA1
bd323942674e555b8cb910555ee95c6b840b4fce

SHA256
bb52306ab62e0e24b60ab9e68239d9f630aa2f656939f3107d51c3b1473fb2ed

SHA512
0b5773dd90f01cf53b5e1b61a9bcfb6df064bf603fc441755df4b21feb7bdb01dd639a95697db714f5139c39f62df927b05ef6862d4e7a90f95107314359f73d

Download Submit
C:\Users\Admin\Desktop\lukitus.htm

MD5
7472b8fdad3e5580c1d6cce8dc513c95

SHA1
efcf9226ba990b639caf907d6c22191489f72e65

SHA256
7bb2a14132d0747137658eb4d56987ad117e1e4fa28239dda2fb991d6f3047fa

SHA512
c9d21d0e3e4f2a2be8d8f84770d9c89e593e48aaccf88e31a4379c4d6682b516bdfed17be6c096d4effbd22a49f809bcfb60145d760f2e7fcc8682026c9ad08b

Download Submit
memory/472-1-0x0000000000000000-mapping.dmp

Download
memory/1612-2-0x0000000000000000-mapping.dmp

Download
memory/1784-0-0x000007FEF7730000-0x000007FEF79AA000-memory.dmp

Filesize
2.5MB

Download
memory/1844-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads