Overview

overview

10

Static

static

117da274f4...b2.exe

windows7_x64

9

117da274f4...b2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2

  • Size

    654KB

  • Sample

    220604-d6fzgsgfa2

  • MD5

    0b40a2fff66d3c7f728b2d0e9ae861a6

  • SHA1

    91f89d87f92ba4f96d16a96c35e56e039adf6979

  • SHA256

    117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2

  • SHA512

    dec02943bb4dfae04c0fcce7cb644aa60277f33cd4747270b4a2d3feb5ca53cf6a5d037eb618bc4c27e3ea266089a2fa8b0ae1fb68f9180fb9b4a15522834c5a

Score
10/10
locky_lukituspersistenceransomware

Malware Config

Targets

    • Target

      117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2

    • Size

      654KB

    • MD5

      0b40a2fff66d3c7f728b2d0e9ae861a6

    • SHA1

      91f89d87f92ba4f96d16a96c35e56e039adf6979

    • SHA256

      117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2

    • SHA512

      dec02943bb4dfae04c0fcce7cb644aa60277f33cd4747270b4a2d3feb5ca53cf6a5d037eb618bc4c27e3ea266089a2fa8b0ae1fb68f9180fb9b4a15522834c5a

    Score
    10/10
    ransomwarelocky_lukituspersistence

    • Locky (Lukitus variant)

      Variant of the Locky ransomware seen in the wild since late 2017.

      ransomwarelocky_lukitus

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Tasks