locky | 5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1

General

Target

5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe
Size

182KB
MD5

f808981cbf3210d6ffb779b144414cac
SHA1

6856fd105f9bea73df88706c5abc40c3b3f9a4db
SHA256

5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1
SHA512

1a4cd00b18faeb2600f74b43dd143259e6d5fd17b60a9dc500d47d1c9ddd21c793df07e8240ff52f09e9fab9b65fc6c1e1cce95be8584e1bbd6980692cb4ac78

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
suricata

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\DebugSearch.tiff	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe
File opened for modification	\??\c:\Users\Admin\Pictures\SyncPush.tiff	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1332 cmd.exe

pid	process
1332	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HELP_instructions.bmp"	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\WallpaperStyle = "0"	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\TileWallpaper = "0"	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000bcae9ca645f5115ce3f5339a2946a42ba93b486871eafe5cd8a33276278c4404000000000e80000000020000200000007000df00abd65e7649b96fa79a6f6d8f46da52a0c8f3791a47c8a793543df56090000000d3d90be07c346173ee8aa5eb3ba7450fadfb5326fcf2934238d1deb0acd7b39d6eeab4664fb44de15cae686177e5d5be0ea618ecbdd88501130e3ca68df8654c5f0b5771d2fdfabb2fe60c99159e7add1e786f50d89aae5b0decffcb1844cb0bde3989bbbab9e9716ef7997dadabe07bf4645b3b6a50fe583e0d2ea844c1ba29cca5613cbb8217f9b50082fcf3ff824340000000599cf958ee636e21d8289a6f456fd76b03e1b7282533269f40365ba118ce118c3d0f2d2efb54c5604a6cdfafc408e1af8934a645299b177b1fdeb35c1fb29d5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec0000000000200000000001066000000010000200000004c58901dc8c0ad08ccd6947989c1ab2f34d1185882ee3002f2363693b77be3e7000000000e8000000002000020000000e623ab5ebe84bc1025b8b5e06fc33069d0a4e13c28f6acd3f13a9964843e81f7200000002b2ae8cee5c1cbcaf60bfd6d3d0333d7a9beb3a23e7650ba6b3fc766d499892940000000fee8d0e15d400935f4baa6c66ef831df99fe44b4141aab9951559298031aba4e33676567d313d45425bd3f803f5d0ed329baa22d627eb5dcce9fbe48a0d50434	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d2d4dd268bd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363210154"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08258DE1-F71A-11EC-A488-4659A2147DF1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

292 iexplore.exe
1972 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

292 iexplore.exe
292 iexplore.exe
1492 IEXPLORE.EXE
1492 IEXPLORE.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

pid process

1036 5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

pid	process
292	iexplore.exe
1972	DllHost.exe

pid	process
292	iexplore.exe
292	iexplore.exe
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE

pid	process
1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exeiexplore.exe

description	pid	process	target process
PID 1036 wrote to memory of 292	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	iexplore.exe
PID 1036 wrote to memory of 292	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	iexplore.exe
PID 1036 wrote to memory of 292	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	iexplore.exe
PID 1036 wrote to memory of 292	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	iexplore.exe
PID 292 wrote to memory of 1492	292	iexplore.exe	IEXPLORE.EXE
PID 292 wrote to memory of 1492	292	iexplore.exe	IEXPLORE.EXE
PID 292 wrote to memory of 1492	292	iexplore.exe	IEXPLORE.EXE
PID 292 wrote to memory of 1492	292	iexplore.exe	IEXPLORE.EXE
PID 1036 wrote to memory of 1332	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	cmd.exe
PID 1036 wrote to memory of 1332	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	cmd.exe
PID 1036 wrote to memory of 1332	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	cmd.exe
PID 1036 wrote to memory of 1332	1036	5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe
"C:\Users\Admin\AppData\Local\Temp\5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_HELP_instructions.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:292 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\5463a73bab1d07f4a43a55b656b1bd24607f9e707654c2f011b428ee64cdffd1.exe"
2⤵
- Deletes itself
PID:1332

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KPL5MTJX.txt
Filesize
604B

MD5
fe7b82209816a4e508767910a542ad07

SHA1
900321e14faeada2a60407f20413d1858a040799

SHA256
ee7d759a9bcebe000d3882e18d00cd655ddbefc9141871ce1c701810af0f2ef1

SHA512
30dd5e25d2af4f7b6f08dabddd97e879c83a4c0b8e7988509e387c2103993755b4249a4481bdd1a1a3eb0f09513f22190a9c3800ef14882e4129165b435b473a

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.bmp
Filesize
3.1MB

MD5
10b6f285c01dfe482c81b6dd3693e3d8

SHA1
22545d7c7c0b8657fd50e639664881a44caf6e31

SHA256
db1b7ad79ef198eea2fee7de396bf62f7f88129335ade741f0871b34af286c12

SHA512
67bc40b58b55e5d012a3e3357c33da14fdd32f1b8440f9bd203f92e8ecc349a4bf38c5ea2a72cdd41b9f82de3c78c86429a1f75e5fdfb5eff56fa8fccdef09a0

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.html
Filesize
8KB

MD5
4f907539235705d406528a279360caf6

SHA1
9677b10eabbaf22ad6b8128a3bbdc1cedeb2dbc9

SHA256
afb23033557feb9e3f70364930e0651927301198377742e9806ff041da9034b3

SHA512
ab1f4e4560d321c647054f526d9ec6009d51e0f570399e6f731454acd88771d2202c783d0b6abaf45466a038b1119aaa3e7939736f397f0e5577ba7371a52a8e

Download Submit
memory/1036-54-0x0000000075941000-0x0000000075943000-memory.dmp

Filesize
8KB

Download
memory/1036-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1036-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1036-58-0x0000000000290000-0x00000000002B6000-memory.dmp

Filesize
152KB

Download
memory/1036-59-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1036-60-0x0000000000290000-0x00000000002B6000-memory.dmp

Filesize
152KB

Download
memory/1036-64-0x0000000000290000-0x00000000002B6000-memory.dmp

Filesize
152KB

Download
memory/1036-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1332-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads