Analysis
-
max time kernel
214s -
max time network
221s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
09-06-2022 00:53
General
-
Target
1649336db033457cb387daba9e83f36b35c8487f1d5dc95356b8a87bad63a749.exe
-
Size
438KB
-
MD5
150eb0b98235ca55a041ea93995bc3ef
-
SHA1
b5ba2c578306e6aeca30892e473ab6a712bfa487
-
SHA256
1649336db033457cb387daba9e83f36b35c8487f1d5dc95356b8a87bad63a749
-
SHA512
6ee5cbf14ce4239bbb6626e4b703cc9895c7ca34ba9bab8b2658fe92b1a9847855e0b3dedb657302d5f2e9d8e03e2f62a2a4dd9444f69f1718bd615ea3de8e31
Score
10/10
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
suricata: ET MALWARE Locky CnC Checkin Dec 5 M1
suricata: ET MALWARE Locky CnC Checkin Dec 5 M1
-
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
Processes
-
C:\Users\Admin\AppData\Local\Temp\1649336db033457cb387daba9e83f36b35c8487f1d5dc95356b8a87bad63a749.exe"C:\Users\Admin\AppData\Local\Temp\1649336db033457cb387daba9e83f36b35c8487f1d5dc95356b8a87bad63a749.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4268-131-0x00000000026D0000-0x00000000026F6000-memory.dmpFilesize
152KB
-
memory/4268-132-0x00000000026D0000-0x00000000026F6000-memory.dmpFilesize
152KB
-
memory/4268-133-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4268-135-0x00000000024B0000-0x00000000024D7000-memory.dmpFilesize
156KB
-
memory/4268-136-0x00000000024B0000-0x00000000024D7000-memory.dmpFilesize
156KB