locky | 8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0 | Triage

Analysis

max time kernel
1783s
max time network
1789s
platform
windows7_x64
resource
win7-20220414-en
submitted
28-06-2022 16:34

Sharing

Report Analysis Logs

General

Target

8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0.exe
Size

186KB
MD5

5706c021ada73e7d15e5ff31f4e47667
SHA1

4e62b9614a3e9ea7f0d6d1aa52cd43b61d03bb37
SHA256

8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0
SHA512

056346ca300083d6c2d40623c943bae2d6ba9dbf0f67a476a665f0688123349fc601051516de1dbad565a2d1ce99a28ba4d74a0c903e85767f13854cf0e91832

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Ransomware Locky CnC Beacon
suricata: ET MALWARE Ransomware Locky CnC Beacon
suricata
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0.exe

pid process

2008 8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0.exe

C:\Users\Admin\AppData\Local\Temp\8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0.exe
"C:\Users\Admin\AppData\Local\Temp\8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2008-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download