Overview

overview

10

Static

static

30a19ce9d1...f6.exe

windows7_x64

10

30a19ce9d1...f6.exe

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30a19ce9d194c8aa8305e863ea46a2a9ae006135789f045d2ccffce46ede22f6

  • Size

    250KB

  • Sample

    220628-v5a6aabbfl

  • MD5

    ad2022689e5de22e2e706b065e148c25

  • SHA1

    a513c42b4cfdcbfa1149180ef68e3570cc964888

  • SHA256

    30a19ce9d194c8aa8305e863ea46a2a9ae006135789f045d2ccffce46ede22f6

  • SHA512

    c3137641672e0e7bd33346fd5b01322d624baf32a978483a2dbc99ff2cf9aaf3550112718a1ea731ba8899fb155cd673cc6a2e03079f71179b759f38317598bf

Score
10/10
lockyransomware

Malware Config

Targets

    • Target

      30a19ce9d194c8aa8305e863ea46a2a9ae006135789f045d2ccffce46ede22f6

    • Size

      250KB

    • MD5

      ad2022689e5de22e2e706b065e148c25

    • SHA1

      a513c42b4cfdcbfa1149180ef68e3570cc964888

    • SHA256

      30a19ce9d194c8aa8305e863ea46a2a9ae006135789f045d2ccffce46ede22f6

    • SHA512

      c3137641672e0e7bd33346fd5b01322d624baf32a978483a2dbc99ff2cf9aaf3550112718a1ea731ba8899fb155cd673cc6a2e03079f71179b759f38317598bf

    Score
    10/10
    lockyransomware

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Loads dropped DLL

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks