locky | 2f1a6b566dc0d2b8e5fcdcf67adc0be912f73fe14c27b262b610dfcd03cd4686

Analysis

max time kernel
129s
max time network
88s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads1/5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe
Size

604KB
MD5

29649c968550c8e97565e81dcce5b81a
SHA1

a08c1bf3c9a73492ad27d793efa057f5582703ac
SHA256

5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78
SHA512

87f09ffc9ebfe5e890e11445a8b856ad3521e2b021da9548e8594b85adb3b99c307224ca4e466f9057a92ead34eb8dceaa2556145676958af1233b6b174eb29f

Score

10^/10

locky persistence ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1964 cmd.exe

pid	process
1964	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\opt321 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Downloads1\\5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe"	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\asasin.bmp"	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\Desktop\WallpaperStyle = "0"	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\Desktop\TileWallpaper = "0"	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000be90cb7453df464aaf2fdba08c04e26b000000000200000000001066000000010000200000004705ca0bc7a78951392e84daf2ca9f37a414ae8292ff260cd1b40ccb4f4ab173000000000e80000000020000200000008057f7854aef7779d9365ee441aaff92734ed859fd89709585eba2b97a7af5b79000000007af97572495c3e1ca8792da8cfb252d4e18e366fcf7e2cdb407bf391192656025e98d49ca2cc31339e032d1ea72c5fa593f4af8dd047ec90d483a4689a93c3fc0faf8a04463e175cc0b57ed44d0928ef5a25e8ca877ba0a66a70f939fa54fd7db58cb9e678d28b453a238fe88d40d911bf9a87db375820e8f5c4364b6fc81042a89152db5432230389eb9231d24233c400000003b48f48cd30b7b375b52f0a428be0bf03e616c163433a162ad26a70bde9c449746afdba0d920ab2af3de14925581cc3d009e808143d0bbbaebe6ffd61f2a2c8d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000be90cb7453df464aaf2fdba08c04e26b00000000020000000000106600000001000020000000f7a5557382b206adad6b81bf28a3b9907b4120a81a059d4e0bdb3b3b5e0284d6000000000e80000000020000200000001aab25ebe0c673842f5788966846ca9c6a0e2309c47ff69046d4fda4986dd4a020000000362cf93cad0b48aca0d59cd860e5da139b5f45fe2c6393af3c6cbc1df1c627e5400000002495df1e3e480bb6fe176036ea1afb107fce324e1ad337ccc4753cf57f395440af30d51db80ff7a16255cf402bff6fbf266d944610227a6e782e85c1bb679868	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1111F7C1-857D-11EB-94CD-F2DC1BF59C8B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c9f1e98919d701	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

description	pid	process
Token: SeDebugPrivilege	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe
Token: SeTakeOwnershipPrivilege	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe
Token: SeBackupPrivilege	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe
Token: SeRestorePrivilege	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1396 iexplore.exe
1004 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1396 iexplore.exe
1396 iexplore.exe
2028 IEXPLORE.EXE
2028 IEXPLORE.EXE

pid	process
1396	iexplore.exe
1004	DllHost.exe

pid	process
1396	iexplore.exe
1396	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exeiexplore.exe

description	pid	process	target process
PID 1288 wrote to memory of 1396	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	iexplore.exe
PID 1288 wrote to memory of 1396	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	iexplore.exe
PID 1288 wrote to memory of 1396	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	iexplore.exe
PID 1288 wrote to memory of 1396	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	iexplore.exe
PID 1396 wrote to memory of 2028	1396	iexplore.exe	IEXPLORE.EXE
PID 1396 wrote to memory of 2028	1396	iexplore.exe	IEXPLORE.EXE
PID 1396 wrote to memory of 2028	1396	iexplore.exe	IEXPLORE.EXE
PID 1396 wrote to memory of 2028	1396	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 1964	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	cmd.exe
PID 1288 wrote to memory of 1964	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	cmd.exe
PID 1288 wrote to memory of 1964	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	cmd.exe
PID 1288 wrote to memory of 1964	1288	5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Downloads1\5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads1\5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\asasin.htm
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\Downloads1\5b712f3ced695dd1510320494ecac67b277c0b386ee465303504c89431f87c78.exe"
2⤵
- Deletes itself
PID:1964

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\asasin.bmp
MD5
d36066f253a24cc079a1bace836bd493

SHA1
8fc6eb1d229f74b73219c98730566891ac89192a

SHA256
d03e9edff4ac947fa0ec4699e72f1b3305e92523da37bada66fc3d89a9a28d87

SHA512
439cd606c5f45681cddbf25e416444e1e9bdc4765011da062abae1e8e00f900da91d41cc86548cbc3cc9d65a1bc3e840066a61b7e3656d882705be6b1ff59446

Download Submit
C:\Users\Admin\Desktop\asasin.htm
MD5
3b5d5e82e8039ce5d6f18a2c7315b59a

SHA1
da271b4bd32efdb41e8e376246c717eae90fdc9a

SHA256
812c85f0e8c31f5b514aa1b43edbfe0c7930255dec41fe2f70eeb3e5cff4ba9f

SHA512
8a73cf239337d36cad9d3b090e922320d82f69e416510301f26bf91f8518efdfa08df7ed355a685d7e6a6a3795954c58753a3a993d113ac675c568faf402db8a

Download Submit
memory/1004-7-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1004-11-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1288-2-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1288-3-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1396-5-0x0000000000000000-mapping.dmp

Download
memory/1964-10-0x0000000000000000-mapping.dmp

Download
memory/2012-4-0x000007FEF6030000-0x000007FEF62AA000-memory.dmp

Filesize
2.5MB

Download
memory/2028-8-0x0000000000000000-mapping.dmp

Download