Overview

overview

10

Static

static

5a99667cc8...8d.exe

windows7_x64

10

5a99667cc8...8d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5a99667cc8f3189edf0907703e2225aec3a015031dee9fc6ebcba291acfb888d

  • Size

    221KB

  • Sample

    220628-tvvw9scdh7

  • MD5

    ff06ce7adf8f6cf1973a6845859ff0b5

  • SHA1

    156b3e27568aa946e2ab4501db813f6b95a24abd

  • SHA256

    5a99667cc8f3189edf0907703e2225aec3a015031dee9fc6ebcba291acfb888d

  • SHA512

    19d6c63f4338a990943cd0e3118d1c32913aa686372a0e25165c4759a0708c364ab451bb1faa07102e49a5c1b95c3fcc5ac75e6c16d5589bc65b9c47533012dd

Score
10/10
lockypersistenceransomware

Malware Config

Targets

    • Target

      5a99667cc8f3189edf0907703e2225aec3a015031dee9fc6ebcba291acfb888d

    • Size

      221KB

    • MD5

      ff06ce7adf8f6cf1973a6845859ff0b5

    • SHA1

      156b3e27568aa946e2ab4501db813f6b95a24abd

    • SHA256

      5a99667cc8f3189edf0907703e2225aec3a015031dee9fc6ebcba291acfb888d

    • SHA512

      19d6c63f4338a990943cd0e3118d1c32913aa686372a0e25165c4759a0708c364ab451bb1faa07102e49a5c1b95c3fcc5ac75e6c16d5589bc65b9c47533012dd

    Score
    10/10
    lockyransomwarepersistence

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks