locky | 287392425199412cc7e9ead557c1b4d1516511f884774cfd0f79feb1300c5d57

Analysis

Target

287392425199412cc7e9ead557c1b4d1516511f884774cfd0f79feb1300c5d57.dll
Size

110KB
MD5

76feaf6e14049057bdfc1606421a2350
SHA1

4df6ea142b356257f9960d6bacda3be20a49df5f
SHA256

287392425199412cc7e9ead557c1b4d1516511f884774cfd0f79feb1300c5d57
SHA512

21fe9f07f4fee39150376a43332395fd1238384ae1361248a17ae0a33313e216593eb1aefec4621c69b4ef1bc21f1110bb367fea10720cf4ebb884ab83d907fd

Score

10^/10

locky ransomware

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1244 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1424 vssvc.exe
Token: SeRestorePrivilege 1424 vssvc.exe
Token: SeAuditPrivilege 1424 vssvc.exe

pid	process
1244	vssadmin.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3516 wrote to memory of 2400	3516	rundll32.exe	rundll32.exe
PID 3516 wrote to memory of 2400	3516	rundll32.exe	rundll32.exe
PID 3516 wrote to memory of 2400	3516	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\287392425199412cc7e9ead557c1b4d1516511f884774cfd0f79feb1300c5d57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\287392425199412cc7e9ead557c1b4d1516511f884774cfd0f79feb1300c5d57.dll,#1
2⤵
PID:2400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
1⤵
- Interacts with shadow copies
PID:1244

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

memory/2400-130-0x0000000000000000-mapping.dmp

Download
memory/2400-131-0x0000000075870000-0x0000000075899000-memory.dmp

Filesize
164KB

Download
memory/2400-132-0x0000000075870000-0x0000000075899000-memory.dmp

Filesize
164KB

Download
memory/2400-134-0x0000000075870000-0x0000000075899000-memory.dmp

Filesize
164KB

Download