Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
16-10-2021 15:03
Static task
static1
Behavioral task
behavioral1
Sample
lockit.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
lockit.exe
Resource
win10-en-20210920
General
-
Target
lockit.exe
-
Size
372KB
-
MD5
e3b3e285390c0e2f7d04bd040bec790d
-
SHA1
dbee71535e9f1fb23b3f01e25989d22d51237e68
-
SHA256
21a0201874af80436dc0a36e5cbaf7da9b75217b3e39b712f3850729cf47deb6
-
SHA512
6156a6b0ff4f41c823cba68a4596676e357ceb5b8c0848c2828a72321dbc2a731d9ae8f1a417fe27aef7de0080001ad3f77b3809b64a93c610ae99f95b35f5be
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
lockit.exedescription ioc process File opened for modification \??\c:\Users\Admin\Pictures\NewWrite.tiff lockit.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 948 cmd.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
lockit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp" lockit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 2 IoCs
Processes:
lockit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop\WallpaperStyle = "0" lockit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\Desktop\TileWallpaper = "0" lockit.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F700021-2EA3-11EC-A1A5-C2A3A902DBDF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ca98e5afc2d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb1936000000000200000000001066000000010000200000008acccd7a213ddde31637cf4d73fe4f28dfd88928792c9bc14c2e13abc34d236d000000000e8000000002000020000000589d602190fb8febf96260208163c775dbdea01c627d37b617ed866d4954963c900000008324d7bfd21bf25008a8bb5f2b8199e6b9c83fdae9b9afb464851486e76a6ccbcf84363a28c52226acb775ebc815092d59dccfbd998690c442ca9f36a0afc227604b61b74d87d0c9fea0b8eebf6e678a8e9857ea2fe8cdd8ac4f472e662477f9989c4b7eb23e150b2b1a5c8db29cca889cdbfbe6fd5ed17d27d6f93fe00326bb74ce6a4ab14435b50d8d91be330a374340000000841849fac728fd3a70fc7ae79b2cb3056b06d02270edd56b51e6dff7585ea01866d3af0779820f55b667aeee7bac89021f31a0ecc26e7911a83cb455209a22b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb193600000000020000000000106600000001000020000000ca9a18a44a1e310923782d5d8d2744615301475623013f5f4348f478f6aa769d000000000e80000000020000200000007118adf659440f875d0cf3eb9f0ea8b11f59f763edec956d7907b98e7630603120000000daa2f176672e8a47bea3883cf105e118e723c9e3a915b3647d6b22406d54f35740000000578f1aa438d1449f94e6329556e288200721f348b5c6198b27b25e851370ee0db2aa292498b5449095471357e62d4e9804445b4bd2fc844e6785dd8677b01256 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "341168820" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
lockit.exepid process 1572 lockit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeDllHost.exepid process 852 iexplore.exe 1928 DllHost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 852 iexplore.exe 852 iexplore.exe 884 IEXPLORE.EXE 884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
lockit.exeiexplore.exedescription pid process target process PID 1572 wrote to memory of 852 1572 lockit.exe iexplore.exe PID 1572 wrote to memory of 852 1572 lockit.exe iexplore.exe PID 1572 wrote to memory of 852 1572 lockit.exe iexplore.exe PID 1572 wrote to memory of 852 1572 lockit.exe iexplore.exe PID 1572 wrote to memory of 948 1572 lockit.exe cmd.exe PID 1572 wrote to memory of 948 1572 lockit.exe cmd.exe PID 1572 wrote to memory of 948 1572 lockit.exe cmd.exe PID 1572 wrote to memory of 948 1572 lockit.exe cmd.exe PID 852 wrote to memory of 884 852 iexplore.exe IEXPLORE.EXE PID 852 wrote to memory of 884 852 iexplore.exe IEXPLORE.EXE PID 852 wrote to memory of 884 852 iexplore.exe IEXPLORE.EXE PID 852 wrote to memory of 884 852 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\lockit.exe"C:\Users\Admin\AppData\Local\Temp\lockit.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:852 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:884 -
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\lockit.exe"2⤵
- Deletes itself
PID:948
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1928
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KD5MQWHP.txtMD5
557f59472504984f70b6e1b0cc009164
SHA1b284c38d3a54ec227ef56ce59940242c9fc83b43
SHA256de836c49238800ec12e13a2b6118de78adf14c300598db0d5c795c03cb4a2f7a
SHA512f08637adff5b5b275db1dcc9916937cfb3ac9cadee52043fcf3ad249be300cc76642b4b8faba4b8e2392732dd7748ee66e38313a8923e49d998296d11f6ec345
-
C:\Users\Admin\DesktopOSIRIS.bmpMD5
efa41ed6905063e3b2b5b2a39b807186
SHA1220cada293f478a140116f5c9ddb062253254538
SHA25613f90453a7d022221c3862318733ecf4c4e941c79ec42beed6680ad48908250a
SHA512a27c1913f2d5f59babd78e9b2f78d1e4f7dfae2607225cc5d807240407b7410fd5b455279f17c98d20bc9a6df8203c5c36639f9ce0fde699fc0f80584ad8d290
-
C:\Users\Admin\DesktopOSIRIS.htmMD5
4a5ca6f80b9a83711b355a93bd34e5bc
SHA120fb0b2c6d257cb42fceeef0e1827c5315eb0200
SHA256b90aabe8d5b245dbc5f9ef0fb7ef9290f4db2e61da38b8354ddfaf7be768087e
SHA512757bb8b9fc24873cec6961eeedc382b1f25006ef5f3c640089217a14c6bc802a5e9500d1eef6f0e48709575de1c8df8b5befeddebbe7e65d01c3dcde372b3d0b
-
memory/852-61-0x0000000000000000-mapping.dmp
-
memory/852-62-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmpFilesize
8KB
-
memory/884-66-0x0000000000000000-mapping.dmp
-
memory/948-65-0x0000000000000000-mapping.dmp
-
memory/1572-59-0x0000000003030000-0x0000000003C7A000-memory.dmpFilesize
12.3MB
-
memory/1572-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1572-60-0x0000000002170000-0x0000000002171000-memory.dmpFilesize
4KB
-
memory/1572-57-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1572-56-0x0000000002170000-0x0000000002171000-memory.dmpFilesize
4KB
-
memory/1572-55-0x0000000003030000-0x0000000003C7A000-memory.dmpFilesize
12.3MB
-
memory/1928-64-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1928-67-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB