Overview

overview

10

Static

static

4d5120b499...le.exe

windows7_x64

10

4d5120b499...le.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26-07-2021 12:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6.sample.exe

  • Size

    142KB

  • MD5

    9dcb4b2e20be4c6d1f4bf4c2bf042bf2

  • SHA1

    f330758e727a129a4a9e8e031076c38b98efc2a6

  • SHA256

    4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6

  • SHA512

    67233aa8925420e8024b42ce5e2cbff9266ed8d539496a8976c5dfa284b457ccd93882ee4294488110f3099030d27afd85cf2c85f49d6b8bb81693bb8704ca16

Score
10/10
lockylocky_osirisransomwaresuricata

Malware Config

Signatures

  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky
  • Locky (Osiris variant)

    Variant of the Locky ransomware seen in the wild since early 2017.

    ransomwarelocky_osiris
  • suricata: ET MALWARE Locky CnC Checkin Dec 5 M1
    suricata
  • suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
    suricata
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\4d5120b49993002b1a1a77298b0e9e486a0aa75eb9fb14fe3c6682a9870203f6.sample.exe"
      2⤵
        PID:664
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2384
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:3804
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:64
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1632
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3328
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4144

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\DesktopOSIRIS.htm
      MD5

      aacacb37e2533918741455f7cb2a882b

      SHA1

      a2203fc3aca16735136ed3d1ad92baed42e4a84c

      SHA256

      ae7e4c047f98dbfc0fa92aeb4bc782df0fdeacdb4609f7ff8fb4f49e3ffa0e3a

      SHA512

      c1fa8d8ac98e537f76f7b098e66047c8c8fadaadac98a003fd3d99fa8c5106e09f73d65fa64f6d936de02b56c6b9e5728cb8ed2b8bab578d4ea69a63b5ae5017

      Download Submit

    • memory/664-117-0x0000000000000000-mapping.dmp

      Download

    • memory/3928-114-0x0000000002E10000-0x0000000002E37000-memory.dmp

      Filesize

      156KB

      Download

    • memory/3928-115-0x00000000013E0000-0x00000000013E1000-memory.dmp

      Filesize

      4KB

      Download