Analysis
-
max time kernel
1624s -
max time network
1627s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
28-06-2022 16:46
Static task
static1
Behavioral task
behavioral1
Sample
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe
Resource
win10v2004-20220414-en
General
-
Target
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe
-
Size
262KB
-
MD5
dfbcb56267bde1b0c5cd2e891c5f1444
-
SHA1
12c74bdb6d04cd4d40f469ae7193e49f862a3aee
-
SHA256
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0
-
SHA512
66075ff634d9d92db61c3f86a5147920ac8e4b325c48227a2a0e96d88c334668153cd963c34fa3a267ceab09c356e4d5551a7c7ecbe20a996979fe4ab4b5abf1
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exedescription ioc process File opened for modification \??\c:\Users\Admin\Pictures\ResumeUnpublish.tiff 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1520 cmd.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HELP_instructions.bmp" 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 2 IoCs
Processes:
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\WallpaperStyle = "0" 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\TileWallpaper = "0" 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c075c8c71f8bd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363207110" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F23F3781-F712-11EC-99C0-66E616BC8074} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd40000000002000000000010660000000100002000000034424844f001606bf8a07ef6d2510ca47704224c2644b479abe2e9983e2cba88000000000e80000000020000200000002bb4d9caea7fdc17788335ddd418b5c28f953ee8a21f0612bde89057112908a120000000cae5787258807e69e641e4e094e6039fb4ab247d7e58affc16030ba0d16c6961400000009406697bec2fca701c881f20a46bd70827f591b611bcfa5cac631982a42c3c160076584d499059f21e807b6b1157c3b5eef4fc15708ffad398f9412d239200d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd4000000000200000000001066000000010000200000001ff7077c62bfcab685257821c3aa478e8dfd12744362c36c5528b963f4571e97000000000e80000000020000200000007bb0b120f8d5240dbfe2f98e703a5777cf0f88686b4d5144171b0f2e7e4d984f9000000088dcbfa61b44e2e5ee8eed34745dbca8779a18e724f2269090b97f188c7005e029c99ab96503c06cc1af291845dc85929af30959cbc90405da5efaa0def8939725d255f94235e14d8e25542a5f9dec72637c7ed0cae0048a7897d8c7f5fcae55bfc4cf9850dcc2aa2531a3d5678bfe9d4039a42809aa0e8331a7284b2723ecdfe6431d5f6fab1858f81ad9e213e6cb4940000000c7ecade85cf9b97c83857c4f5f3744f49981d45ead3ab7ed534d2eee8fd923c00e5d957ceda76b3d614eada50dc234b5d2c4b59135064077ae70e724acacfb37 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeDllHost.exepid process 936 iexplore.exe 1956 DllHost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 936 iexplore.exe 936 iexplore.exe 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exepid process 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exeiexplore.exedescription pid process target process PID 1992 wrote to memory of 936 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe iexplore.exe PID 1992 wrote to memory of 936 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe iexplore.exe PID 1992 wrote to memory of 936 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe iexplore.exe PID 1992 wrote to memory of 936 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe iexplore.exe PID 936 wrote to memory of 2008 936 iexplore.exe IEXPLORE.EXE PID 936 wrote to memory of 2008 936 iexplore.exe IEXPLORE.EXE PID 936 wrote to memory of 2008 936 iexplore.exe IEXPLORE.EXE PID 936 wrote to memory of 2008 936 iexplore.exe IEXPLORE.EXE PID 1992 wrote to memory of 1520 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe cmd.exe PID 1992 wrote to memory of 1520 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe cmd.exe PID 1992 wrote to memory of 1520 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe cmd.exe PID 1992 wrote to memory of 1520 1992 9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe"C:\Users\Admin\AppData\Local\Temp\9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_HELP_instructions.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:936 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2008 -
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\9e803068b0df00f2681f79d31f27aee618cf65456aed57e3a8247995f4e2d4c0.exe"2⤵
- Deletes itself
PID:1520
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1956
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\91HLSQG2.txtFilesize
604B
MD56de8677e06eff5f0a91474f263c2631c
SHA1e2195e1988d5d8ba46ce146377cc23a43d349a0d
SHA25620d558d73008ca6863c27b3eda706d2521aa3db21ef16190a7ca92ae62dc8e4d
SHA5120cde08984b56bf86059c2b382abb9c16f339623962a30a18001cce7ac152ed4e61a96f2b983c08642425ed603215985632d856e5d471694466aa7d02bc18b86c
-
C:\Users\Admin\Desktop\_HELP_instructions.bmpFilesize
3.1MB
MD5f8a7eabcc6fffbcd8a25f64b5662f9d5
SHA17da92a85e4eda43fbe4300053a796bc97a774510
SHA25640c97e104e4b3d4ee2127460824f4d87b6cdb58021f3d4308c58640ae90c9f2b
SHA51276095217c909aca09ccbc17f026490894e05ee2e09010a3bf2e1153f5d9a5bfc94c55153aea36369c4aea39b34251cd05eeef672aa6f189f2644900974fe6f87
-
C:\Users\Admin\Desktop\_HELP_instructions.htmlFilesize
8KB
MD56d56008d00a1bc179b334821506b8d8b
SHA15873a2bd01e0d8f4352b5f8bffa9838f47409f6f
SHA256d1b3192f42949d30d4a248dcc4f7d0a4850ed24785e97943f98e6f84f78c62be
SHA512317d89f3dfc2588feda982f47d0abccc438330025fed069610c120173e90881c55e7835f318be0a76279201423e1171c3c5e357dee4d482bf9058fff9c02f91c
-
memory/1520-62-0x0000000000000000-mapping.dmp
-
memory/1992-54-0x0000000075381000-0x0000000075383000-memory.dmpFilesize
8KB
-
memory/1992-56-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1992-57-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1992-58-0x00000000005E0000-0x0000000000606000-memory.dmpFilesize
152KB
-
memory/1992-59-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1992-60-0x00000000005E0000-0x0000000000606000-memory.dmpFilesize
152KB
-
memory/1992-63-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1992-64-0x00000000005E0000-0x0000000000606000-memory.dmpFilesize
152KB