locky | 33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603 | Triage

Analysis

max time kernel
135s
max time network
152s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-06-2022 01:14

Sharing

Report Analysis Logs

General

Target

33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603.exe
Size

232KB
MD5

8e5be600c26f2459d250a8cf1f5841cc
SHA1

f9f0b8ecda2f63119364fb591e14c69bc7960b96
SHA256

33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603
SHA512

b1b6dd14247d36e8218fcd9da64e7bf7609663aab73f600ef4a6bcadc7e8e4e4c77936b3a4aa886fc1d8380aeaf0d9608040a0f44060eccaaa698e8c6d103ac8

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Ransomware Locky CnC Beacon
suricata: ET MALWARE Ransomware Locky CnC Beacon
suricata
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603.exe

pid process

644 33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603.exe

C:\Users\Admin\AppData\Local\Temp\33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603.exe
"C:\Users\Admin\AppData\Local\Temp\33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

Filesize
8KB

Download
memory/644-55-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download
memory/644-57-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download