locky | 28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce

General

Target

28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
Size

770KB
MD5

8ac7c66efdeefceea010123faa515cdf
SHA1

961c26caade6bb374efb19319411f04183af2cb0
SHA256

28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce
SHA512

621d2229400f1900fa78852551b2447577d72b5fe482206b3a2c37c928c9db12057419fde4e5cf81e5deb086618d128b5db1dac7fb26b5fc44ab2765e508c798

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\UnblockAdd.tiff	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
File opened for modification	\??\c:\Users\Admin\Pictures\MountGrant.tiff	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
File opened for modification	\??\c:\Users\Admin\Pictures\NewExit.tiff	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1944 cmd.exe

pid	process
1944	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\asasin.bmp"	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

648 vssadmin.exe

pid	process
648	vssadmin.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\WallpaperStyle = "0"	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\TileWallpaper = "0"	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000e6a737dcd62d3faaf5a1aa597bbd986212d7493efe499697ed0e6cc93b13644d000000000e8000000002000020000000aaa245a0514a2193f62a9044ceebf2d539716fe1844f1a60696a822f5bccc3b9200000002f29d9209fcef4806b1af2ce3a926cec6136a2f8214a03a44d01e3a282b185a84000000050b6ab0f6ca23b3ceb257bb4a0355d1ac5992535e6932975fb992a13ebc757ada1fea88a4321532c9515490a9b2f90898650f7b0347281d526b08bed03ddd0c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000003a688bd391a2cbf68e25cae606237a073d6e62ce7cafec7e0a9fdb5948b94d81000000000e80000000020000200000004e413d73f6c7425504a66e507090ca7adf361f5a89aa1bf4bdbb0c4a02ecfa3690000000e94347d2ed1646dc6f4878bacc3a3a50689b85d1558661da6deeb528ee6cf87b6f3d7aaff8af37389eb327c370376324e22ea61597ca8377782b8fb64b489a40c2e8cad7c693cf9aa0d34ceda7a3c825237d701afba59a27e4c2433f9ac27aba9fa1ccb3eaf113c1070c4faab571a80b872e6e62a2699bd23be334b4f5821b30bae89d26330b935116a3d5abfcca626b400000003ed7925fed8777f7abe45dece3843d2f045b99757629b24a935c04fa09eae0eaad25b75574b917ead427b806c8bec1e97c5ed7b6efef4b26fde0f539f419e13d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362089682"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B0EB731-ECE9-11EC-917F-6AE7990DC39D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f035eb10f680d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
Token: SeTakeOwnershipPrivilege	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
Token: SeBackupPrivilege	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
Token: SeRestorePrivilege	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
Token: SeBackupPrivilege	1740	vssvc.exe
Token: SeRestorePrivilege	1740	vssvc.exe
Token: SeAuditPrivilege	1740	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1424 iexplore.exe
1620 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1424 iexplore.exe
1424 iexplore.exe
324 IEXPLORE.EXE
324 IEXPLORE.EXE

pid	process
1424	iexplore.exe
1620	DllHost.exe

pid	process
1424	iexplore.exe
1424	iexplore.exe
324	IEXPLORE.EXE
324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

taskeng.exe28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exeiexplore.exe

description	pid	process	target process
PID 1704 wrote to memory of 648	1704	taskeng.exe	vssadmin.exe
PID 1704 wrote to memory of 648	1704	taskeng.exe	vssadmin.exe
PID 1704 wrote to memory of 648	1704	taskeng.exe	vssadmin.exe
PID 1648 wrote to memory of 1424	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	iexplore.exe
PID 1648 wrote to memory of 1424	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	iexplore.exe
PID 1648 wrote to memory of 1424	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	iexplore.exe
PID 1648 wrote to memory of 1424	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	iexplore.exe
PID 1648 wrote to memory of 1944	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	cmd.exe
PID 1648 wrote to memory of 1944	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	cmd.exe
PID 1648 wrote to memory of 1944	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	cmd.exe
PID 1648 wrote to memory of 1944	1648	28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe	cmd.exe
PID 1424 wrote to memory of 324	1424	iexplore.exe	IEXPLORE.EXE
PID 1424 wrote to memory of 324	1424	iexplore.exe	IEXPLORE.EXE
PID 1424 wrote to memory of 324	1424	iexplore.exe	IEXPLORE.EXE
PID 1424 wrote to memory of 324	1424	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe
"C:\Users\Admin\AppData\Local\Temp\28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\asasin.htm
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce.exe"
  2⤵
  - Deletes itself
  PID:1944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\system32\taskeng.exe
taskeng.exe {373D1864-ADA7-4F1E-A9D9-2EFC04C06788} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\vssadmin.exe
  C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
  2⤵
  - Interacts with shadow copies
  PID:648

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1MX0S02C.txt

Filesize
601B

MD5
142f42e05b1165208ba4fbb655190a8b

SHA1
e51f9f2bc61284782db665cfdb4a8716d104ad40

SHA256
83e2c31d8826345eeb8bdc8178ff37426e1263af43070cc48bb7f2ef78d75177

SHA512
fc0faa80cd04ecf15ed8cf6dc208525de1823e125b34c1e4f7b9e60f6eec8313428109a8ebcb938cc6c1538cb8dc2aec03b3b2246fd5232309d754a870df3cef

Download Submit
C:\Users\Admin\Desktop\asasin.bmp

Filesize
3.5MB

MD5
4f39cbbdfddb5bd031baa5787005ea35

SHA1
d6b3a31db8fec1060c558f7d3a09031a5577a816

SHA256
67786db0ef712280bc5546027d40ec0a8873dc18be6edcacd755d7cd1b8530ce

SHA512
527cfbb2b196dffa808a4ee0ebfea93cf31c23e9f59253a4c4bc89525add1492ffe167d5be5070d39cba08314d4e76328bf24a8b4179ce3fb38ec70fb1108e56

Download Submit
C:\Users\Admin\Desktop\asasin.htm

Filesize
9KB

MD5
37aa83bff082404da7fd7a75ee856d11

SHA1
f1da475c723be1ca4d95cf7975fdd8de42a8cd96

SHA256
7555edb10d785bb08f4d478aca4a49c333077475bfda876a211a1eecd27865d3

SHA512
138fcce2050ab8b4bbd07f323dba66bbf1857852f1d7bcb2b8cfd4d140c23257a216a67ccb89d21d05d40e93aa35de08278d4ce43bcb3949c56d4bcaebda07f9

Download Submit
memory/648-59-0x0000000000000000-mapping.dmp

Download
memory/1648-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1648-55-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1648-58-0x0000000001CF0000-0x0000000001D79000-memory.dmp

Filesize
548KB

Download
memory/1944-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads