Overview

overview

10

Static

static

20161205_6...632.js

windows7_x64

10

20161205_6...632.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20161205_68bb06732c39ba6463f32b8bcca60632.js

  • Size

    13KB

  • Sample

    211117-nwbxwscdc2

  • MD5

    a8c790a74fc4e6393c2e313850ade203

  • SHA1

    bf379612245b298ed742fbbf3634f8557781f098

  • SHA256

    a53f9d5213aea33f49e7f679fb5c436da2890430c0c3a4611638d3a64154784d

  • SHA512

    f1de9ab8c9b39643c8c66602a9de6185ff3dc1ebbe4bdfd9b5678f5e8f3cac43ae57c5a51cf55bf7357eda28bb04dacead7f7222077917eade83f1a40690add5

Score
10/10
lockylocky_osirisransomware

Malware Config

Targets

    • Target

      20161205_68bb06732c39ba6463f32b8bcca60632.js

    • Size

      13KB

    • MD5

      a8c790a74fc4e6393c2e313850ade203

    • SHA1

      bf379612245b298ed742fbbf3634f8557781f098

    • SHA256

      a53f9d5213aea33f49e7f679fb5c436da2890430c0c3a4611638d3a64154784d

    • SHA512

      f1de9ab8c9b39643c8c66602a9de6185ff3dc1ebbe4bdfd9b5678f5e8f3cac43ae57c5a51cf55bf7357eda28bb04dacead7f7222077917eade83f1a40690add5

    Score
    10/10
    lockylocky_osirisransomware

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Locky (Osiris variant)

      Variant of the Locky ransomware seen in the wild since early 2017.

      ransomwarelocky_osiris

    • Blocklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks