locky | e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
05/03/2022, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe
Size

595KB
MD5

1c1a6b70b5e2b13c019d5cbdf0f12738
SHA1

d21b9d5ca7327bb1ca57aaf8752e7764a3334fe8
SHA256

e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4
SHA512

f6c37079d3f7ae55cfdb1e588830d30bad4b820afc7765c20081a501fe916c6b1b8aa78090801ecb7f3776ae8766987220af5a4eb2639b7d87f56721be7bc675

Score

10^/10

locky persistence ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\ResumeMount.tiff	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\ykcol.bmp"	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1eca3365-b0a3-4a47-aae7-48dd1204ebdf.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220305231239.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
2684	vssadmin.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\WallpaperStyle = "0"	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\TileWallpaper = "0"	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3988	msedge.exe
3988	msedge.exe
2604	identity_helper.exe
2604	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2968	vssvc.exe
Token: SeRestorePrivilege	2968	vssvc.exe
Token: SeAuditPrivilege	2968	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3988	3636	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe	72
PID 3636 wrote to memory of 3988	3636	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe	72
PID 3988 wrote to memory of 1536	3988	msedge.exe	73
PID 3988 wrote to memory of 1536	3988	msedge.exe	73
PID 3636 wrote to memory of 3540	3636	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe	74
PID 3636 wrote to memory of 3540	3636	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe	74
PID 3636 wrote to memory of 3540	3636	e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe	74
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 1276	3988	msedge.exe	76
PID 3988 wrote to memory of 3420	3988	msedge.exe	78
PID 3988 wrote to memory of 3420	3988	msedge.exe	78
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77
PID 3988 wrote to memory of 1900	3988	msedge.exe	77

C:\Users\Admin\AppData\Local\Temp\e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe
"C:\Users\Admin\AppData\Local\Temp\e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ykcol.htm
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb923146f8,0x7ffb92314708,0x7ffb92314718
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3396 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,13214907757449582777,10557087283700233751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff78ccf5460,0x7ff78ccf5470,0x7ff78ccf5480
      4⤵
      PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\e5bafdd9d27defccb5c62db15a0374ccdeedb6a279b33776e8fc1ecb728d70e4.exe"
  2⤵
  PID:3540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
1⤵
- Interacts with shadow copies
PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-142-0x00007FFB9EC90000-0x00007FFB9EC91000-memory.dmp

Filesize
4KB

Download
memory/3636-130-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3636-131-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3636-133-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3636-132-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download