locky | d3f7159425c0e6b1c076d12eacb62345188cd9fbc7fb74052a5b3b220df91e2f

Analysis

max time kernel
151s
max time network
131s
platform
windows10_x64
resource
win10-en-20211104
submitted
18/11/2021, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20161205_bc36f1ce16f62adcd3368593f2c4ece0.js
Size

12KB
MD5

ec1eaa7630980202c2ea84f4f99d8f14
SHA1

7458ab3e869639e7e4fa55dd98994961ebd94f66
SHA256

d3f7159425c0e6b1c076d12eacb62345188cd9fbc7fb74052a5b3b220df91e2f
SHA512

9ff4b87c973694ae2ddf8102b06d9de2dc1758d71e70239cd2ade1e83352f1e324d225bd6a63d2045631f52e34c96c774af24fb8fdaa7e35598349f99cf92d9f

Score

10^/10

locky locky_osiris ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris

Blocklisted process makes network request 11 IoCs

flow	pid	Process
9	3584	wscript.exe
12	3584	wscript.exe
13	3584	wscript.exe
15	3584	wscript.exe
18	3584	wscript.exe
20	3584	wscript.exe
37	812	rundll32.exe
45	812	rundll32.exe
46	812	rundll32.exe
48	812	rundll32.exe
49	812	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
812	rundll32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\WallpaperStyle = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\TileWallpaper = "0"	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 492	3584	wscript.exe	69
PID 3584 wrote to memory of 492	3584	wscript.exe	69
PID 492 wrote to memory of 812	492	rundll32.exe	70
PID 492 wrote to memory of 812	492	rundll32.exe	70
PID 492 wrote to memory of 812	492	rundll32.exe	70

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\20161205_bc36f1ce16f62adcd3368593f2c4ece0.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\MTCLMW~1.ZK,TOxNKCZjUHCfTf9D
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\MTCLMW~1.ZK,TOxNKCZjUHCfTf9D
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Sets desktop wallpaper using registry
    - Modifies Control Panel
    PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact