locky | 1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6

General

Target

1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
Size

634KB
MD5

c77d1c0c0ecd0b2f81f2bcf89fb07279
SHA1

be7d13c25052903d150ed07e836e210e298b9995
SHA256

1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6
SHA512

a967039c4a9804b3ff51c25fafa93322f983eaa52fe4361cae3f5a54c02eafc0bea8e848a3e94ba17e09622b53466dabef14c1a775f0958f06c6aa8e70b9e091

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\CompareCopy.tiff	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
File opened for modification	\??\c:\Users\Admin\Pictures\OpenAssert.tiff	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1912 cmd.exe

pid	process
1912	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\asasin.bmp"	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

640 vssadmin.exe

pid	process
640	vssadmin.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\WallpaperStyle = "0"	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\TileWallpaper = "0"	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{504E4901-E61B-11EC-AB75-7E3B55B31640} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "361341534"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000004de34496a7cd27145b6d996028f2b15182d00fa402f6f61e6a551b7e943be157000000000e80000000020000200000008349ddefe8dc2f5dec7509b9cd5e9c52f0a793d6b9bfe94aafc7fc65c3ed4fe5200000007a0796da5f884dbf31b5e968772a935c94243cc7a44a6dc98c3f2e3688d4a4c540000000f1eeac799da7c755e3bf52217a3dbf7cc11ee318106103103f6ef372b0620c0e1f7d3dafc6029f4c7b5418e9c8efd62a1f6b8c685f08747b0a263741a4165aee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000ec2818deb1e38d6fe9e26e3942f970e423973e795425c2b7b3cd314ff7932edd000000000e800000000200002000000037882b16150df3c4fcd328daab4839805c9ba35bd2e97c66bf7f41e777a346c4900000003ed5de325f17f0019623b0bfac6b173406a655fd94ecd108f22e84ea20ee4ad395e8f6336a0b1e380b5e8359bdb67fa2f03f1d43d721a5d18212e43d47ea771fee287b823981874fcbfb889f5907a54671f97f3fc03c4e47912237919ceb6309b79c7316477dcc0c8cb6bb83e9b5ba7832c5fca3e8103129f313233bdef2d05f174f557019c0f746afb5597c5d274d1440000000532538ad36203bee35e7bb5b80554b36c968d3a06983e73c61e21d9c5a0fd22597fb22c5a01de3d30c9331e1b386e2273daf947609aba753fedac263d79b0fd5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601ce125287ad801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
Token: SeTakeOwnershipPrivilege	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
Token: SeBackupPrivilege	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
Token: SeRestorePrivilege	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
Token: SeBackupPrivilege	1980	vssvc.exe
Token: SeRestorePrivilege	1980	vssvc.exe
Token: SeAuditPrivilege	1980	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1164 iexplore.exe
1136 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1164 iexplore.exe
1164 iexplore.exe
1700 IEXPLORE.EXE
1700 IEXPLORE.EXE

pid	process
1164	iexplore.exe
1136	DllHost.exe

pid	process
1164	iexplore.exe
1164	iexplore.exe
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

taskeng.exe1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exeiexplore.exe

description	pid	process	target process
PID 1496 wrote to memory of 640	1496	taskeng.exe	vssadmin.exe
PID 1496 wrote to memory of 640	1496	taskeng.exe	vssadmin.exe
PID 1496 wrote to memory of 640	1496	taskeng.exe	vssadmin.exe
PID 1504 wrote to memory of 1164	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	iexplore.exe
PID 1504 wrote to memory of 1164	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	iexplore.exe
PID 1504 wrote to memory of 1164	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	iexplore.exe
PID 1504 wrote to memory of 1164	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	iexplore.exe
PID 1504 wrote to memory of 1912	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	cmd.exe
PID 1504 wrote to memory of 1912	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	cmd.exe
PID 1504 wrote to memory of 1912	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	cmd.exe
PID 1504 wrote to memory of 1912	1504	1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe	cmd.exe
PID 1164 wrote to memory of 1700	1164	iexplore.exe	IEXPLORE.EXE
PID 1164 wrote to memory of 1700	1164	iexplore.exe	IEXPLORE.EXE
PID 1164 wrote to memory of 1700	1164	iexplore.exe	IEXPLORE.EXE
PID 1164 wrote to memory of 1700	1164	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe
"C:\Users\Admin\AppData\Local\Temp\1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\asasin.htm
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\1d4a3957a4f4d83f1edffcb0b596e04d98c82f801ae4b23208a34076203f42f6.exe"
2⤵
- Deletes itself
PID:1912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\system32\taskeng.exe
taskeng.exe {AC4415E4-99F8-41E5-93A8-71033E4B7775} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
2⤵
- Interacts with shadow copies
PID:640

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B19HLP2L.txt
Filesize
606B

MD5
7d4fc71c461d7dfef4cd007d5d3aba5c

SHA1
927b6916ef5b402fd53df5cca28895968995efaf

SHA256
d9d8dc3a6d201237dd1039e9c98a0e3345cd730598028c691e05af2fae7132f8

SHA512
d63850770d43654f287a1039ad858fc9b9ebc1459836ee5a976176d5bd96e864982df3b864d7b79c621bcbac54f7a5440ca2581c0d12caafc51fade0ac5db852

Download Submit
C:\Users\Admin\Desktop\asasin.bmp
Filesize
3.3MB

MD5
9a8d39c8114333faead728ef67245fbb

SHA1
ceb9d13b8bcc348e0ab1871498869d8f3825a334

SHA256
e4051c34edde178eb5bed34e903729d016159cb1b076a90241ef9811b4e16c5a

SHA512
e7d0153f50cf6df64385c0210d5d1dbae08663cb51795a48855ee03b5d0186d9d57608536c88016987d5c32d42d90136606ef9e2b6748a53919a9c6a306cf8e5

Download Submit
C:\Users\Admin\Desktop\asasin.htm
Filesize
8KB

MD5
e3d8d61fc2cc8c41397bf3d1c46cd6db

SHA1
a9c4da6b6ca0db6309dc09353322dbc2cc152cf6

SHA256
8b537b0f5a7cdd921b3a443729c7b648df8aee161dbd3e3dc2296f939ef919f9

SHA512
c31213d7ad135fefeb3f5767684f1e487b6215f6da23d483b4dc9554a3d2e6e8655a95f796add4edeccc663da2e06c571bc732e2ee02e3ced7e96194aaf4ed53

Download Submit
memory/640-59-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1504-56-0x0000000000400000-0x00000000004A5BB0-memory.dmp

Filesize
662KB

Download
memory/1504-58-0x0000000000400000-0x00000000004A5BB0-memory.dmp

Filesize
662KB

Download
memory/1504-62-0x0000000000400000-0x00000000004A5BB0-memory.dmp

Filesize
662KB

Download
memory/1912-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads