locky | af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347

General

Target

af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe
Size

256KB
MD5

beddff97291279cbff84fa55fa85dcc8
SHA1

1a76fc9fcee3ec83e339248197d036789a03e7b8
SHA256

af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347
SHA512

5c0147e4098afae2dc4a0b801f3b637335801acae0811e99a2c0e0353c8a4433126ff3ace0f276d11c688ea85b8c2b6d7da17f21a489d8c1bddc37f091ce3c6a

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
suricata

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\ResumeApprove.tiff	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

816 cmd.exe

pid	process
816	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HELP_instructions.bmp"	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\WallpaperStyle = "0"	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\TileWallpaper = "0"	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363212627"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000a7d66d440a05b75793a7c114d42f376dcf288b0903ca062d610582ca3bf18caf000000000e80000000020000200000008215eb561fff38662f66ad9c0df7f91db6947153334a308623de6885b89fceac900000000f3d7d8664ac3d3b971108c6bb9b768621f1d9990155a859dca20a878917f150072aaff2fe1d0f1427ead785d42fdb2d830d1cb858c0c5254543d97812f055a73fd077aeb2250a6771de40cfb5951832c4b9216b9046e5002abf6b1c2e5c11c9100413fe02948cbb326fb3d67a5364b8ae7940c534295f62c3c987a6a04ec53b3d29c198e260c259db7725f468514448400000000469a7751e3fdf78a2c07f84101e0d899f097a9a5332be3431f928845d7258db188a8cc84a6a80c012bda8cb4d2324f8aba311d40947bca7936aa8ecce63466e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400de59f2c8bd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA440911-F71F-11EC-8BAB-C6DEEDF3EE1E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000d8314e3dd1458e0231d8fb26e1456d06cf62963d03602e1673c13cdfa1b8bc7e000000000e80000000020000200000000e39ab53181b4b765da5ce49dcd9eb6cef14d68050f3cd79e3c150eb8cf9cc1d20000000ba51aa0df58146a71e9900fdeac5f1ad0546bbce757174473bfb1514c817c57540000000215f5621379ed1f7259ef12c369529603881c7bc9b3fbff1b03c8e5d955c4eda3f4d0049b5d27c49d04d4021643aa47365c0b1356e65269bf61c907ad12f82a1	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

384 iexplore.exe
612 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

384 iexplore.exe
384 iexplore.exe
1200 IEXPLORE.EXE
1200 IEXPLORE.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

pid process

1284 af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

pid	process
384	iexplore.exe
612	DllHost.exe

pid	process
384	iexplore.exe
384	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

pid	process
1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exeiexplore.exe

description	pid	process	target process
PID 1284 wrote to memory of 384	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	iexplore.exe
PID 1284 wrote to memory of 384	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	iexplore.exe
PID 1284 wrote to memory of 384	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	iexplore.exe
PID 1284 wrote to memory of 384	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	iexplore.exe
PID 384 wrote to memory of 1200	384	iexplore.exe	IEXPLORE.EXE
PID 384 wrote to memory of 1200	384	iexplore.exe	IEXPLORE.EXE
PID 384 wrote to memory of 1200	384	iexplore.exe	IEXPLORE.EXE
PID 384 wrote to memory of 1200	384	iexplore.exe	IEXPLORE.EXE
PID 1284 wrote to memory of 816	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	cmd.exe
PID 1284 wrote to memory of 816	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	cmd.exe
PID 1284 wrote to memory of 816	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	cmd.exe
PID 1284 wrote to memory of 816	1284	af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe
"C:\Users\Admin\AppData\Local\Temp\af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1284

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_HELP_instructions.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\af7797bf0df65314f3173e06b114b0498ee0d76c35a243376d1bc1efc4a01347.exe"
2⤵
- Deletes itself
PID:816

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FCL8EPMR.txt
Filesize
603B

MD5
093e011d2180cd42905dfde8ebafbf3b

SHA1
12ac0ea196c793c3a5a35747ebb21aa9cb451f6f

SHA256
cb3ae0ed7df1a4ff495d1acb12a0bd5743afd4d6f60aff5e2099e6277f176ba4

SHA512
f741fda4f0c8f70b620b024cd4b2713568445bccd02f61555bffd2f008313b264da3110a4010ef0414f3dde790e84716348157d9f15ae0a89dd14a6525d03b03

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.bmp
Filesize
3.1MB

MD5
fbbe4b94409511b4acca6a110cb31eeb

SHA1
f4e0aad83e5a4acf5608f12f169352ef3a226d12

SHA256
c0026a18148af173241ac9adb02ffeb490b7e26245b66ea1bd33caa0f6528d80

SHA512
d5b015e091ee51cebb144ea54f89e17163bc373cb782245b8ca3e88d87a919bc35604cc8eab79f9e13949b5babf88db0f4ce4c3127400a5c75694d20069187a0

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.html
Filesize
8KB

MD5
6d56008d00a1bc179b334821506b8d8b

SHA1
5873a2bd01e0d8f4352b5f8bffa9838f47409f6f

SHA256
d1b3192f42949d30d4a248dcc4f7d0a4850ed24785e97943f98e6f84f78c62be

SHA512
317d89f3dfc2588feda982f47d0abccc438330025fed069610c120173e90881c55e7835f318be0a76279201423e1171c3c5e357dee4d482bf9058fff9c02f91c

Download Submit
memory/816-61-0x0000000000000000-mapping.dmp

Download
memory/1284-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1284-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1284-57-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1284-58-0x0000000000260000-0x0000000000286000-memory.dmp

Filesize
152KB

Download
memory/1284-59-0x0000000000260000-0x0000000000286000-memory.dmp

Filesize
152KB

Download
memory/1284-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1284-63-0x0000000000260000-0x0000000000286000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads