Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-11-2020 19:39
Static task
static1
Behavioral task
behavioral1
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
Resource
win10v20201028
General
-
Target
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
-
Size
657KB
-
MD5
8009e4433aad21916a7761d374ee2be9
-
SHA1
e0538c4bb3d0310f827799c98707b681d1f91b45
-
SHA256
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea
-
SHA512
404f98fb57d0842aa43d5a113a395ff1d5d963ae60bce81d4dc22f3f0b382a7ba06703b0d7404a240e5edf5f1f75f8bc9b980a966bd29b9e432cd09cb1507071
Malware Config
Signatures
-
Locky (Lukitus variant)
Variant of the Locky ransomware seen in the wild since late 2017.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1688 cmd.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\lukitus.bmp" 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe -
Modifies Control Panel 2 IoCs
Processes:
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\WallpaperStyle = "0" 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\TileWallpaper = "0" 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81A876B1-1F9F-11EB-8030-C611B4A1F110} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeDllHost.exepid process 524 iexplore.exe 588 DllHost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 524 iexplore.exe 524 iexplore.exe 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exeiexplore.exedescription pid process target process PID 1704 wrote to memory of 524 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe iexplore.exe PID 1704 wrote to memory of 524 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe iexplore.exe PID 1704 wrote to memory of 524 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe iexplore.exe PID 1704 wrote to memory of 524 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe iexplore.exe PID 524 wrote to memory of 1952 524 iexplore.exe IEXPLORE.EXE PID 524 wrote to memory of 1952 524 iexplore.exe IEXPLORE.EXE PID 524 wrote to memory of 1952 524 iexplore.exe IEXPLORE.EXE PID 524 wrote to memory of 1952 524 iexplore.exe IEXPLORE.EXE PID 1704 wrote to memory of 1688 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe cmd.exe PID 1704 wrote to memory of 1688 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe cmd.exe PID 1704 wrote to memory of 1688 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe cmd.exe PID 1704 wrote to memory of 1688 1704 2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe"C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\lukitus.htm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:524 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe"2⤵
- Deletes itself
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\lukitus.bmpMD5
aa84167fbde8fba1f29e81a60e68a334
SHA183fa79c1d9c43f7481de9cb83e2b954962a583e6
SHA2565fa2df0f7098af70ebae6ecb0aecd1045d4a5d3a260591976d0e678735a32555
SHA512a8b6e1f0141d21beb041204078f0423bb344b9f50efdfc94a3edab7f896d1bebe7cbfde3c308a5e1a2d33f900665b15a5cbb0893b6120442da9fefaaea4ff98f
-
C:\Users\Admin\Desktop\lukitus.htmMD5
2dff6c42d0530c27834958fa2efe42ad
SHA17ddc346a34e6d4f1e1d412b31bfa14c1dd02efa4
SHA256cdf07831dc4faf8a3c3dfbfd52f170a4d7cbb9e69212697bed8eb1719fbc29a6
SHA5124b3e18bc06a8ddde628c85a588af657bac5b1dfa3cc9f9373973618a5d9c23dc15ba50066172b1255be37d5d6905e236ad0b56585c60ce890b1e8102d503683d
-
memory/524-1-0x0000000000000000-mapping.dmp
-
memory/1388-0-0x000007FEF7C70000-0x000007FEF7EEA000-memory.dmpFilesize
2.5MB
-
memory/1688-3-0x0000000000000000-mapping.dmp
-
memory/1952-2-0x0000000000000000-mapping.dmp