Overview

overview

10

Static

static

8

04443c70d3...be.exe

windows7_x64

9

04443c70d3...be.exe

windows10_x64

9

05535d72f3...06.exe

windows7_x64

1

05535d72f3...06.exe

windows10_x64

1

1bec139d54...72.exe

windows7_x64

8

1bec139d54...72.exe

windows10_x64

8

1f670ff8cc...55.exe

windows7_x64

1

1f670ff8cc...55.exe

windows10_x64

1

2deaa0ec74...ea.exe

windows7_x64

10

2deaa0ec74...ea.exe

windows10_x64

10

372b929ae9...ef.dll

windows7_x64

9

372b929ae9...ef.dll

windows10_x64

9

38ee6bea62...15.exe

windows7_x64

3

38ee6bea62...15.exe

windows10_x64

3

437d91ce52...8f.exe

windows7_x64

1

437d91ce52...8f.exe

windows10_x64

4

447058c1c6...a8.exe

windows7_x64

9

447058c1c6...a8.exe

windows10_x64

9

5061c0b08d...03.exe

windows7_x64

1

5061c0b08d...03.exe

windows10_x64

1

5ed4b682ef...d4.exe

windows7_x64

8

5ed4b682ef...d4.exe

windows10_x64

8

6970600d21...b5.exe

windows7_x64

1

6970600d21...b5.exe

windows10_x64

1

72f528f9a6...92.exe

windows7_x64

8

72f528f9a6...92.exe

windows10_x64

8

73dcee7abe...99.exe

windows7_x64

1

73dcee7abe...99.exe

windows10_x64

1

7e118b534a...d2.exe

windows7_x64

10

7e118b534a...d2.exe

windows10_x64

10

8034fffb03...3c.exe

windows7_x64

10

8034fffb03...3c.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-03-2021 09:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe

  • Size

    657KB

  • MD5

    8009e4433aad21916a7761d374ee2be9

  • SHA1

    e0538c4bb3d0310f827799c98707b681d1f91b45

  • SHA256

    2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea

  • SHA512

    404f98fb57d0842aa43d5a113a395ff1d5d963ae60bce81d4dc22f3f0b382a7ba06703b0d7404a240e5edf5f1f75f8bc9b980a966bd29b9e432cd09cb1507071

Score
10/10
locky_lukitusransomware

Malware Config

Signatures

  • Locky (Lukitus variant)

    Variant of the Locky ransomware seen in the wild since late 2017.

    ransomwarelocky_lukitus
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
    "C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe"
    1⤵
    • Checks computer location settings
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe"
      2⤵
        PID:2588
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:612
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:1200
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3640
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2560
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1108

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\lukitus.htm
      MD5

      5bce4a98e907745b61693c96fcf447a9

      SHA1

      2e8a6c5eb8754bdfb2c75b6d5b7c3a0b679f3477

      SHA256

      1158054575506804e81087beda353d7aaa3c862891c7256d87f426c0212c173c

      SHA512

      f36628625b6bb2f36b3f5fc4ec2ad47903c6d47c59b7357125cab573173d09b77a4d4fa42926ff59f3e6ef5c433ac3d719bbcfe466b0ac24ef46c726c4b9019b

      Download Submit

    • memory/1196-2-0x0000000000401000-0x0000000000478000-memory.dmp

      Filesize

      476KB

      Download

    • memory/1196-3-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1196-4-0x0000000000910000-0x0000000000911000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2588-6-0x0000000000000000-mapping.dmp

      Download