locky | d3f7159425c0e6b1c076d12eacb62345188cd9fbc7fb74052a5b3b220df91e2f

General

Target

20161205_bc36f1ce16f62adcd3368593f2c4ece0.js
Size

12KB
MD5

ec1eaa7630980202c2ea84f4f99d8f14
SHA1

7458ab3e869639e7e4fa55dd98994961ebd94f66
SHA256

d3f7159425c0e6b1c076d12eacb62345188cd9fbc7fb74052a5b3b220df91e2f
SHA512

9ff4b87c973694ae2ddf8102b06d9de2dc1758d71e70239cd2ade1e83352f1e324d225bd6a63d2045631f52e34c96c774af24fb8fdaa7e35598349f99cf92d9f

Score

10^/10

locky locky_osiris ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris

Blocklisted process makes network request 11 IoCs

Processes:

wscript.exerundll32.exe

flow	pid	process
9	3584	wscript.exe
12	3584	wscript.exe
13	3584	wscript.exe
15	3584	wscript.exe
18	3584	wscript.exe
20	3584	wscript.exe
37	812	rundll32.exe
45	812	rundll32.exe
46	812	rundll32.exe
48	812	rundll32.exe
49	812	rundll32.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

812 rundll32.exe

pid	process
812	rundll32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\WallpaperStyle = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\TileWallpaper = "0"	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

wscript.exerundll32.exe

description	pid	process	target process
PID 3584 wrote to memory of 492	3584	wscript.exe	rundll32.exe
PID 3584 wrote to memory of 492	3584	wscript.exe	rundll32.exe
PID 492 wrote to memory of 812	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 812	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 812	492	rundll32.exe	rundll32.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\20161205_bc36f1ce16f62adcd3368593f2c4ece0.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\MTCLMW~1.ZK,TOxNKCZjUHCfTf9D
2⤵
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\MTCLMW~1.ZK,TOxNKCZjUHCfTf9D
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MTCLMW~1.ZK
MD5
6b760fbbefa7f8dd1daaa93ebc38725a

SHA1
81841f24244485dae1c1834df3e544893d258f06

SHA256
c564dcc24fa9909a4482feb46d52fa96869a2ad6c8c87b5cbeee19b9b36a0ff6

SHA512
6ea91469538c40dada22b66373da0deb57f48d9d535e5ebd8199b5074a26c93a297386389a58468032dec1aef36423271d7ffaf84feba772b531c9ccd46fc68a

Download Submit
\Users\Admin\AppData\Local\Temp\MTCLMW~1.ZK
MD5
6b760fbbefa7f8dd1daaa93ebc38725a

SHA1
81841f24244485dae1c1834df3e544893d258f06

SHA256
c564dcc24fa9909a4482feb46d52fa96869a2ad6c8c87b5cbeee19b9b36a0ff6

SHA512
6ea91469538c40dada22b66373da0deb57f48d9d535e5ebd8199b5074a26c93a297386389a58468032dec1aef36423271d7ffaf84feba772b531c9ccd46fc68a

Download Submit
memory/492-118-0x0000000000000000-mapping.dmp

Download
memory/812-120-0x0000000000000000-mapping.dmp

Download
memory/812-122-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/812-123-0x0000000074250000-0x000000007428A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads