locky | c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30

General

Target

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
Size

206KB
MD5

f08c3b7ace25f1ce76bebd3429762ef8
SHA1

8a6585bafa9ed8341051c062b149242b727fd8b0
SHA256

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30
SHA512

aff55b078294628e4b992a423ce80b32c288eca28b160d4e6e23f6dd01cb2d48c26a8a45db9d8a14e21a73506d7e1b1cafdbe072192193181de38be62acb4dc6

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\PublishCheckpoint.tiff	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

324 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

pid process

1948 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

pid	process
324	cmd.exe

pid	process
1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HOWDO_text.bmp"	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

description	pid	process	target process
PID 1948 set thread context of 700	1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\WallpaperStyle = "0"	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\TileWallpaper = "0"	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363212809"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000db733bcd058b04b29a67b5fddcf3914939935513d1f2c226cfdae324fa1ebd48000000000e800000000200002000000073a5453e440f1e080bca85b673bf06c95b53dcaeb2a67f2335cfc16ed7fe53af200000004ba7441e1454f9a0bf9314e461436c905c7be382f5ae4b4ac6706024c8b19a3940000000e9794282cb59ef061626e9cb8a62045102e63978300cbb6b702949bd702bf5961137729738fda058d53f3b86b86353d259c4435044b4368a1111eb0e73146656	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000451b36cd2f1f2d329f67a4c23f51d25b7742f6d0b5fe8a58050cc5516d1b7d62000000000e8000000002000020000000717b6cfa61df6303e392d7a77d081bc43fd53aef6afaa30b17d8795045eb0ff1900000004499c29352418601ee7f78f17a3acf575d0699a96e759bc785bbde2bcae4ba736179434b41909f23cf1419a2ca627c9b9cb397f72bdecc582840d4a6fad26df1a92d8007cbb913da4e402d49cfcdfed8cc5a3d1571ffdcfe48e568551382839a383443dfd1131540d474768c1381e37676c3fefa031f19215276acc332cfc7aa9d95ab2aa207b5ab121bcd8c51a7634a40000000b8773536cc103aa98c0030c1f5a127692c3e617302befa6a58cdd3893f2cf538491dc88e1026e8f6bc6a9d84b3eaba829d2c06af143f47ce39db0e23cb021b5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302f2a0c2d8bd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36B3FBF1-F720-11EC-9E6F-E6BBD082ACA2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

pid process

1948 c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1544 iexplore.exe
1776 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1544 iexplore.exe
1544 iexplore.exe
1040 IEXPLORE.EXE
1040 IEXPLORE.EXE

pid	process
1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe

pid	process
1544	iexplore.exe
1776	DllHost.exe

pid	process
1544	iexplore.exe
1544	iexplore.exe
1040	IEXPLORE.EXE
1040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exec127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exeiexplore.exe

description	pid	process	target process
PID 1948 wrote to memory of 700	1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
PID 1948 wrote to memory of 700	1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
PID 1948 wrote to memory of 700	1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
PID 1948 wrote to memory of 700	1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
PID 1948 wrote to memory of 700	1948	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
PID 700 wrote to memory of 1544	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	iexplore.exe
PID 700 wrote to memory of 1544	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	iexplore.exe
PID 700 wrote to memory of 1544	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	iexplore.exe
PID 700 wrote to memory of 1544	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	iexplore.exe
PID 1544 wrote to memory of 1040	1544	iexplore.exe	IEXPLORE.EXE
PID 1544 wrote to memory of 1040	1544	iexplore.exe	IEXPLORE.EXE
PID 1544 wrote to memory of 1040	1544	iexplore.exe	IEXPLORE.EXE
PID 1544 wrote to memory of 1040	1544	iexplore.exe	IEXPLORE.EXE
PID 700 wrote to memory of 324	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	cmd.exe
PID 700 wrote to memory of 324	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	cmd.exe
PID 700 wrote to memory of 324	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	cmd.exe
PID 700 wrote to memory of 324	700	c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
"C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe
"C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"
2⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:700

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_HOWDO_text.html
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1040

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\c127b95c9d4710e862ca8b477928b78b43bcfb6655c27462a7c644daac1e3c30.exe"
3⤵
- Deletes itself
PID:324

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UC2MFVN8.txt
Filesize
599B

MD5
1ab1fc74cae8a90b8a6b451a4f721720

SHA1
1e8193bb5b05468e1ba5ef458ae8d84ff2235ae3

SHA256
36adba10efbe7ed80b6cdd38fce8dc12541b5a9384ddbb21b0a254fe5467b233

SHA512
8c6cc915a34423c9583ba376d97c8e58c4d574bb820141054b97b1ea7aeb7aba43bd81cc1dc8ffb70d754b6939b27ff607b86da997f0bd8bd809a7eae21e8bda

Download Submit
C:\Users\Admin\Desktop\_HOWDO_text.bmp
Filesize
3.5MB

MD5
5712470aac14e46b14679840f9bbaad6

SHA1
701ba35b5186de23695ff4c612e10e7d8985666a

SHA256
feea31824c902d9450208271cdb902a5169a44cf41c9446760c6779d8319001b

SHA512
f11e1a9ae954ef0a72743123954b0dc937adc4a7758bc2a71dcc43c2d39a41ae55777cedf39d41a1cf14031d728322f7a6bcf9cf8b3a497f8542a6580b30a121

Download Submit
C:\Users\Admin\Desktop\_HOWDO_text.html
Filesize
8KB

MD5
844f46a194471b4a01b9bf64579b2388

SHA1
c05d0b6d010e68e258e00e9f55134c4e3fcc338c

SHA256
4b52fc4a44e24c662be4c7a6c44f9a547f9f8d587adad4a8de9719b171c39d56

SHA512
939dc2680a390b964134d61aeef22d925b53691425bb3a75e14f51540e906023f8672ea5562f26fe9d0cc4262f6f9a2d4642e2c86745a1b461220e6d4068a00d

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE9B6.tmp\System.dll
Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
memory/324-63-0x0000000000000000-mapping.dmp

Download
memory/700-57-0x00000000001C560B-mapping.dmp

Download
memory/700-60-0x00000000001C0000-0x00000000001E7000-memory.dmp

Filesize
156KB

Download
memory/700-61-0x0000000000280000-0x00000000002A7000-memory.dmp

Filesize
156KB

Download
memory/700-64-0x0000000000280000-0x00000000002A7000-memory.dmp

Filesize
156KB

Download
memory/1948-54-0x0000000076721000-0x0000000076723000-memory.dmp

Filesize
8KB

Download
memory/1948-56-0x0000000000450000-0x0000000000477000-memory.dmp

Filesize
156KB

Download
memory/1948-59-0x0000000000450000-0x0000000000477000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads