Analysis

  • max time kernel
    156s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-03-2021 09:49

General

  • Target

    2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe

  • Size

    657KB

  • MD5

    8009e4433aad21916a7761d374ee2be9

  • SHA1

    e0538c4bb3d0310f827799c98707b681d1f91b45

  • SHA256

    2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea

  • SHA512

    404f98fb57d0842aa43d5a113a395ff1d5d963ae60bce81d4dc22f3f0b382a7ba06703b0d7404a240e5edf5f1f75f8bc9b980a966bd29b9e432cd09cb1507071

Malware Config

Signatures

  • Locky (Lukitus variant)

    Variant of the Locky ransomware seen in the wild since late 2017.

  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe
    "C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe"
    1⤵
    • Modifies extensions of user files
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\lukitus.htm
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1016
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\2deaa0ec7445c26f1442f860eb32f4fcda2d501699d09a94c26035d6185803ea.exe"
      2⤵
      • Deletes itself
      PID:892
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
      PID:364

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\lukitus.htm
      MD5

      f1f66d26bfe5938cc51940440bf1f8fe

      SHA1

      8c75aa0d4f206951605521e26722ba1af00a4581

      SHA256

      1ae8dab2540e34524ffb90d0a22a1b31ad9a026a673038d60aed61b7ab3cf0b5

      SHA512

      2ed3c22e5fe47e41caa43ed8f306b091e235bc7e41a3405fd7acd8ae08ee79ee3c2e623f4679166801a75241a066c02b228fbd7b1a46056a50633bf6eb2019d2

    • memory/364-10-0x00000000000B0000-0x00000000000B2000-memory.dmp
      Filesize

      8KB

    • memory/364-12-0x00000000001E0000-0x00000000001E1000-memory.dmp
      Filesize

      4KB

    • memory/892-11-0x0000000000000000-mapping.dmp
    • memory/1016-8-0x0000000000000000-mapping.dmp
    • memory/1076-2-0x0000000075D61000-0x0000000075D63000-memory.dmp
      Filesize

      8KB

    • memory/1076-3-0x0000000000401000-0x0000000000478000-memory.dmp
      Filesize

      476KB

    • memory/1076-4-0x00000000002C0000-0x00000000002C1000-memory.dmp
      Filesize

      4KB

    • memory/1076-5-0x00000000002E0000-0x00000000002E1000-memory.dmp
      Filesize

      4KB

    • memory/1164-7-0x0000000000000000-mapping.dmp
    • memory/1472-6-0x000007FEF7900000-0x000007FEF7B7A000-memory.dmp
      Filesize

      2.5MB