locky | 91ef42b0f28693e070c042894f5a6283ad8d4441f66599f59e5e9561ab988371 | Triage

Analysis

max time kernel
1789s
max time network
1799s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-06-2022 16:41

Sharing

Report Analysis Logs

General

Target

91ef42b0f28693e070c042894f5a6283ad8d4441f66599f59e5e9561ab988371.exe
Size

169KB
MD5

020bb86c656898af5324939f708becb7
SHA1

8b0211be15a138bc201a839f9255a0ff927055e3
SHA256

91ef42b0f28693e070c042894f5a6283ad8d4441f66599f59e5e9561ab988371
SHA512

cbff17a7adbd1434ae482016bab1d8c99f5b9f6d7ab89644a480f73ca8cc2224d12ef5b4a98e7dcdfa40303e40bb2a9f976ebe3e7f0754a0884a84f6dd80e0c9

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Ransomware Locky CnC Beacon
suricata: ET MALWARE Ransomware Locky CnC Beacon
suricata
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

91ef42b0f28693e070c042894f5a6283ad8d4441f66599f59e5e9561ab988371.exe

pid process

2076 91ef42b0f28693e070c042894f5a6283ad8d4441f66599f59e5e9561ab988371.exe

C:\Users\Admin\AppData\Local\Temp\91ef42b0f28693e070c042894f5a6283ad8d4441f66599f59e5e9561ab988371.exe
"C:\Users\Admin\AppData\Local\Temp\91ef42b0f28693e070c042894f5a6283ad8d4441f66599f59e5e9561ab988371.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-130-0x00000000009A0000-0x00000000009CF000-memory.dmp

Filesize
188KB

Download
memory/2076-131-0x00000000009A0000-0x00000000009CF000-memory.dmp

Filesize
188KB

Download
memory/2076-133-0x00000000009A0000-0x00000000009CF000-memory.dmp

Filesize
188KB

Download
memory/2076-134-0x00000000009A0000-0x00000000009CF000-memory.dmp

Filesize
188KB

Download