locky | 615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea

General

Target

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
Size

229KB
MD5

71a6c0050e81a206bf884490902924c6
SHA1

40f4a8e11d5605cba585aa7f8fae27d350a641ae
SHA256

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea
SHA512

5a5c70dac73ce0dbe841f875d56ba13b2cdb9c34569dcaa6216c3a82b2633239e8b82c79985ecee43720425813eec9574c3005f840fce9c5b583cc7847107048

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\MergeRename.tiff	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1968 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

pid process

1280 615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

pid	process
1968	cmd.exe

pid	process
1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_WHAT_is.bmp"	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

description	pid	process	target process
PID 1280 set thread context of 992	1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\WallpaperStyle = "0"	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\TileWallpaper = "0"	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363198654"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b0000000002000000000010660000000100002000000071dce2c199aaa0a48b677d2cf7ab0e346b1378458af2a0eaf47b935d82398d38000000000e80000000020000200000003cb93620008ae4b23af934e9ea34cb5dab50af6d235a0fac0c49d8b74ce00d3190000000054addf475495d2bb562c397368d144fd66cf2f7f7509ed91f6d3bdb98faf494386846340e0d525860dd4bb8935d392e996206b81c3c66940447fe22b42b039f1a587b773a067af380d5862c1d32c4e81953e05321453b3e449f67a8f4fd6fa238227af5ee05cebb407b5255134dbcee0bee307a18dca99a73790dc4708583892ce30e159a2ac06a7ca5c737ddb672d240000000ced406af552c6632e5f7127a8894281c223480df622a515a97ff24aca1ae907cc78c0bd7575915314001df9dceef419f1044f1a44696bd0236b2241210782734	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b000000000200000000001066000000010000200000006acec38468d1a0762301fac78a3a3828d2e5691acfc9348a88a1902399fe0d18000000000e80000000020000200000000b1acb5e991be21dfe485e70389e461705b5cd7a534104be9055ecb72b2d51cd20000000030395aedc5de9a69578e959d7cb256a2064389b13e4ea177045d46ef9f07fcd400000003da2dc6f33e163cd24c5f752524a25a1d9ed95594b302197f7f66d68fbed96cc1d8b153d93aab395eaaaa1bbc1b12427a60567340b0ad06d18226b67d724e9ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41CD7501-F6FF-11EC-8749-4224C87335A1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f364170c8bd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

pid process

1280 615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1336 iexplore.exe
860 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1336 iexplore.exe
1336 iexplore.exe
932 IEXPLORE.EXE
932 IEXPLORE.EXE

pid	process
1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe

pid	process
1336	iexplore.exe
860	DllHost.exe

pid	process
1336	iexplore.exe
1336	iexplore.exe
932	IEXPLORE.EXE
932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exeiexplore.exe

description	pid	process	target process
PID 1280 wrote to memory of 992	1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
PID 1280 wrote to memory of 992	1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
PID 1280 wrote to memory of 992	1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
PID 1280 wrote to memory of 992	1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
PID 1280 wrote to memory of 992	1280	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
PID 992 wrote to memory of 1336	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	iexplore.exe
PID 992 wrote to memory of 1336	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	iexplore.exe
PID 992 wrote to memory of 1336	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	iexplore.exe
PID 992 wrote to memory of 1336	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	iexplore.exe
PID 1336 wrote to memory of 932	1336	iexplore.exe	IEXPLORE.EXE
PID 1336 wrote to memory of 932	1336	iexplore.exe	IEXPLORE.EXE
PID 1336 wrote to memory of 932	1336	iexplore.exe	IEXPLORE.EXE
PID 1336 wrote to memory of 932	1336	iexplore.exe	IEXPLORE.EXE
PID 992 wrote to memory of 1968	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	cmd.exe
PID 992 wrote to memory of 1968	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	cmd.exe
PID 992 wrote to memory of 1968	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	cmd.exe
PID 992 wrote to memory of 1968	992	615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
"C:\Users\Admin\AppData\Local\Temp\615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe
"C:\Users\Admin\AppData\Local\Temp\615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe"
2⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:992

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_WHAT_is.html
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\615e495a8d65383745b59f8571caf94fd6db68a9912d3d93662cab7b6d0cbaea.exe"
3⤵
- Deletes itself
PID:1968

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9FEBMFOH.txt
Filesize
601B

MD5
4fbc4eee59723ac0e9cf07e69fad555d

SHA1
522d2cd79a52fda873895dffd460ac89c2fff328

SHA256
f4d6f8d46ffddffabb79123e6fe5efe4a62d412407080e3f41d18cd10457f262

SHA512
9f9a53db10dbe6e027596ad60f4b7616b526193eb7e67eab4510add8c25ff77dd0d596fe27b54f567b1f6ab69385795825b9715eb3388b26aae3b3f52db5e4f3

Download Submit
C:\Users\Admin\Desktop\_WHAT_is.bmp
Filesize
3.4MB

MD5
509119309ac215322fed43d6de7f6a73

SHA1
1025fb38c33448dd8c6eb11ecde3421f9dfbffb2

SHA256
5a9076d7296b44b1c978580cf75935e3d937d59499b4d3e8d6713afe2f6fea8a

SHA512
e330e086be77d5eaf1c704dca1db09f9dff008a4ab42142e39e515aaafb630a78a2eb9564791a1919bb5c5030f33b1efbd0b634b13ba886cc372325a915b41da

Download Submit
C:\Users\Admin\Desktop\_WHAT_is.html
Filesize
9KB

MD5
565a84711600625397b98af48f79afb2

SHA1
c0eaa189c18c1852296bc2c53db03062d4d37625

SHA256
2a27a1807c98feda70a8fa0dbb558db10f2c5a0557d4bb69e943004ee3295dba

SHA512
954733adb73aaf5ebb92f68d3f51945403d659f2cc3e4a28e5d1f73e2fdf261588f22a900a7fb7a2d790bca5b0d98090278363f1e117979ca4d63e214223f2f6

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF8B4.tmp\System.dll
Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
memory/992-61-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/992-60-0x00000000001C0000-0x00000000001E7000-memory.dmp

Filesize
156KB

Download
memory/992-62-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/992-65-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/992-57-0x00000000001C5673-mapping.dmp

Download
memory/1280-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1280-59-0x0000000000330000-0x0000000000357000-memory.dmp

Filesize
156KB

Download
memory/1280-56-0x0000000000330000-0x0000000000357000-memory.dmp

Filesize
156KB

Download
memory/1968-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads