Overview

overview

10

Static

static

15924247d5...f8.exe

windows7_x64

10

15924247d5...f8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15924247d54593ba80ebdb0dbaaf7983423a28406eef138416c2d79635d774f8

  • Size

    327KB

  • Sample

    220628-tfmmcacch8

  • MD5

    2a8279553fbb943a05effc3a9d0f5922

  • SHA1

    03ab1e5f301ef598025ee7abb49db184fe8a48e3

  • SHA256

    15924247d54593ba80ebdb0dbaaf7983423a28406eef138416c2d79635d774f8

  • SHA512

    da989092f60d7248785578721e6845574cb0a8a8852bc50d701cdc34f75fa144b4724d1be985ce933bc9540c3c90aa7cd0e957be34baebce315d39e1fdb52d0d

Score
10/10
lockyadwarediscoverypersistenceransomwarestealer

Malware Config

Targets

    • Target

      15924247d54593ba80ebdb0dbaaf7983423a28406eef138416c2d79635d774f8

    • Size

      327KB

    • MD5

      2a8279553fbb943a05effc3a9d0f5922

    • SHA1

      03ab1e5f301ef598025ee7abb49db184fe8a48e3

    • SHA256

      15924247d54593ba80ebdb0dbaaf7983423a28406eef138416c2d79635d774f8

    • SHA512

      da989092f60d7248785578721e6845574cb0a8a8852bc50d701cdc34f75fa144b4724d1be985ce933bc9540c3c90aa7cd0e957be34baebce315d39e1fdb52d0d

    Score
    10/10
    lockyransomwareadwarediscoverypersistencestealer

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks