locky | 5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8

General

Target

5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe
Size

174KB
MD5

50bde00178dbc70e43d8e6156e9a1c0d
SHA1

26a7bc0b6fd83644b1df1f0378dec013026c4971
SHA256

5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8
SHA512

b7e98b367e977b914b182ddf182f88a7e8be35e8eaef2dea69f21027b7f7d7faa5913d01f71a1d4e89e0dfc6b4f0331bda824f776209213852575ec236c44bd5

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1916 cmd.exe

pid	process
1916	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HELP_instructions.bmp"	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\WallpaperStyle = "0"	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\TileWallpaper = "0"	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000e660c70e385453d79db1bff3aba65e14351a6e0030b2d2da78a1720659f27650000000000e8000000002000020000000972a5c5b532b7fa0de5709609b653165d2ac1b6e2ae6aab814f3d25440d7cb49200000000af045ce41adf2abd8e9e497ff11d05b61d38b9922738e8475879a34df0b4fa74000000022716bc56948004aac04f498b6b040bef44254e54eef61d3b7949d812fe9e24e1b782d6020099318f591534063e842835769841d5f38ae64b4af8166de2437fd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000a52043fe18e30e5fe83cd6e140e025deffee908795acaf5cdfe208b6fb032f57000000000e80000000020000200000002700a714c42485965226382757c7f07a69180f96ed149cb46e7177ca4c16c2c990000000224835ed287012dc5d596c81a3114d1a17bf04cadb82a4170a40241f08c40d3cd599f88a5817460093dc1194f74779e7f0a1237feba2862da794b2fe74ea1047ebcfc7e5c857214a9ddc8967f892266452c3697ac78e033d7579999b4e7364913b89f9c4dbc4501b80914294528bfd9bb20f6e749cf1f7e39a4e1a4399ad221fd2079f6b131db1a0018dd73cc4447293400000000300e6e55bd2ca21909ef81e48ef11ad7f03a4045767726d3400475916f879f9837f95e03b265e1ced3aaf4759894915e33c09ea4669fd4f78bdd8fa80d83051	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363198409"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFDC57B1-F6FE-11EC-96D0-66E616BC8074} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d4c4850b8bd801	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

856 iexplore.exe
1748 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

856 iexplore.exe
856 iexplore.exe
1280 IEXPLORE.EXE
1280 IEXPLORE.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe

pid process

1668 5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe

pid	process
856	iexplore.exe
1748	DllHost.exe

pid	process
856	iexplore.exe
856	iexplore.exe
1280	IEXPLORE.EXE
1280	IEXPLORE.EXE

pid	process
1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exeiexplore.exe

description	pid	process	target process
PID 1668 wrote to memory of 856	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	iexplore.exe
PID 1668 wrote to memory of 856	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	iexplore.exe
PID 1668 wrote to memory of 856	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	iexplore.exe
PID 1668 wrote to memory of 856	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	iexplore.exe
PID 856 wrote to memory of 1280	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 1280	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 1280	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 1280	856	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 1916	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	cmd.exe
PID 1668 wrote to memory of 1916	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	cmd.exe
PID 1668 wrote to memory of 1916	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	cmd.exe
PID 1668 wrote to memory of 1916	1668	5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe
"C:\Users\Admin\AppData\Local\Temp\5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1668

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_HELP_instructions.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1280

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\5776efe08fd2b5847cafd084ed56e0457de02608e6c8e4e971c8e00cc3355fa8.exe"
2⤵
- Deletes itself
PID:1916

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\90OZGM49.txt
Filesize
602B

MD5
985db52f8a76bfe3ce2b1ecfd21fc7f1

SHA1
31a568e1e8a53f2d0020e01f5dcb6eb53cac347a

SHA256
396ecef94b97a67a64880e9242a813819a71e6252a1a5201197d78a320a8317d

SHA512
e124266df1f1edcdcaa5ee892a3b87a034b32100486d3c01810bf3793b50526a6cd59b9845ee31f21047a9bbfc2b5bb19de2e9d1fb21f6a56ef2c59002d8006d

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.bmp
Filesize
3.5MB

MD5
77e225eed157923173c3a52df0acb78f

SHA1
f4c37dfa407658e34b523ee34895345f72a79b7c

SHA256
5d33e09700e4e2e580c629d8eab6c88b62c00a174f5f29e3e27745875fa6af21

SHA512
765f773fbeaf7743042e3c23d4719118545ff9864255e09b67230aba7ec034ef6375c48b34182f2172dd5a5a3b1ad1f9d32452f343455a0e263874c77876e7aa

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.html
Filesize
9KB

MD5
fbc9ecb8af74f93041589b2167e6375c

SHA1
616b71032e7e3d788281cc152972995091658c67

SHA256
661458b38041eee8acd7e423a9ebbf6b782a04494ee142733805f9276e4148bf

SHA512
95f6a2a7b58558a6049904e27ec35f67caafe338cb0fe4c17b9d6010efb094382b8c5be6eb1a83926a975a4421f5adaf2eea8334c45381d4142eb2b607414b1f

Download Submit
memory/1668-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-61-0x0000000000250000-0x0000000000276000-memory.dmp

Filesize
152KB

Download
memory/1668-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-58-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1668-66-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-67-0x0000000000250000-0x0000000000276000-memory.dmp

Filesize
152KB

Download
memory/1668-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1668-71-0x0000000000250000-0x0000000000276000-memory.dmp

Filesize
152KB

Download
memory/1668-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1916-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads