locky | 0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537

General

Target

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
Size

249KB
MD5

1cc0cca4d5d49aba352f4cc93aed3f6f
SHA1

e7db8694074d1a2c7ac097eff4c085debe389d73
SHA256

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537
SHA512

fa127310e53e2bb80f6ea27574e2a28eddd180df0ce00fe49d53f4ba508550f5100943a4db8ac1a786468acada99fe0b1476b73417d8fa4d0349eb62a390a29e

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\ConvertToRequest.tiff	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1052 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

pid process

1276 0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

pid	process
1052	cmd.exe

pid	process
1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_WHAT_is.bmp"	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	pid	process	target process
PID 1276 set thread context of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\WallpaperStyle = "0"	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\TileWallpaper = "0"	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363212905"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000008e76a55001ba558e5895c6b13ac521ae8b1a46191e9a7445c1b090917603a860000000000e80000000020000200000007f02ae8b245f4c8230248b954ecbecd0023c59c19b815ea62de0b5db612f13ce200000000d44307fbb0fa72ddda9d43b23d352316b290429b7daa7e686b64660eae76a6f400000007b68a5fc6c24b7c34f195d05b0c84b03394a5bd210e693dc1ea71fb9fe9ec046d5dc1303e03df6ac0d09bbda54a1916d59f71f25442bf16f499a926be3679627	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F9B7D31-F720-11EC-99E8-F2D3CC06C800} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a26f462d8bd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c00000000020000000000106600000001000020000000f7e0a0d3d4d9104691863f020c996b441d511efbf6b58301ca3c1666aa880c79000000000e8000000002000020000000f6ae5539616c4006b62d16df6e103f70936aef01818380344b52f31ff24c9376900000008693d8ed97bbe2334a58595dc8149fce1e0d45303b654a74774d75ae8bf5aaa48531330572e254fc681cc5607722171f020377c2c92506005921491b14e80098c044d0258400cb0d4642ecfea783c0892a4b3fc2f5ea7fa6f822fc5b204f727b38e9dc002d121f5e717956235b69754820fa9c4734cc96931dd3706cc2505d4f2babef279320a1b6c6620507338050f040000000d95857181982d6edf0906148c540c02214cd592746e0533cdd1dacd21c22c08a19c63e32730695f10f7e34d7e367fbd3af98b3179204f4c417edba67d3c1ea7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

pid process

1276 0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

2004 iexplore.exe
1424 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2004 iexplore.exe
2004 iexplore.exe
792 IEXPLORE.EXE
792 IEXPLORE.EXE

pid	process
1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe

pid	process
2004	iexplore.exe
1424	DllHost.exe

pid	process
2004	iexplore.exe
2004	iexplore.exe
792	IEXPLORE.EXE
792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exeiexplore.exe

description	pid	process	target process
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1276 wrote to memory of 1968	1276	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
PID 1968 wrote to memory of 2004	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	iexplore.exe
PID 1968 wrote to memory of 2004	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	iexplore.exe
PID 1968 wrote to memory of 2004	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	iexplore.exe
PID 1968 wrote to memory of 2004	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	iexplore.exe
PID 1968 wrote to memory of 1052	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	cmd.exe
PID 1968 wrote to memory of 1052	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	cmd.exe
PID 1968 wrote to memory of 1052	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	cmd.exe
PID 1968 wrote to memory of 1052	1968	0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe	cmd.exe
PID 2004 wrote to memory of 792	2004	iexplore.exe	IEXPLORE.EXE
PID 2004 wrote to memory of 792	2004	iexplore.exe	IEXPLORE.EXE
PID 2004 wrote to memory of 792	2004	iexplore.exe	IEXPLORE.EXE
PID 2004 wrote to memory of 792	2004	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
"C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe
"C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe"
2⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1968

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_WHAT_is.html
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:792

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\0d80447ad564ffd0c40cc71213787f823de1b058dc1aa856aa67f438dd51d537.exe"
3⤵
- Deletes itself
PID:1052

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PSVK9BV2.txt
Filesize
604B

MD5
5e42b0de13a79f14fa4b0b97e4a6647a

SHA1
8a605d0ea264fddb1f23eb50cc8f51c1760a4e79

SHA256
2466e973c67bebadc31c7042a1895803db45306606b1865a0309785bd57c81da

SHA512
577a956a3291c346277d339576399438247c3ad880c7356f39cac1e76e974ea4259c6102c02a0703458e4706b462fa509fb0fe9e7bf053b5c204644368d9edf8

Download Submit
C:\Users\Admin\Desktop\_WHAT_is.bmp
Filesize
3.5MB

MD5
bb3fcb97de9e73c1ab7625659e5ead6c

SHA1
9de2c2b5f4d6debbaea8ea465582495e940a10de

SHA256
7297ddf0513cb26bcf12e9860896355e152604fcb27706ac9fd3df349935c535

SHA512
747433deb42f58bc195a1159ce0c7b2d0ca5a8bc5b811da5ae3f73b4f85bad5de6a800b7967efc80da03aeba03d1b2755fedcd22f1c9038b66570c63c306135b

Download Submit
C:\Users\Admin\Desktop\_WHAT_is.html
Filesize
9KB

MD5
18c8982d20ba5e153f13dfd4323027a7

SHA1
cc0acf4eef77f0ec7fe7fd12cd4deea4fdba89c4

SHA256
c2ab0c305c37c70bfeb46c5bede8fdef1a3ba37ef683390aa6c8f5ad00efaead

SHA512
6c32f85d92be771b049c9aeb463fbe071144ed8ef866d311b81d812daa933bcdda0226aa8a0c657ef67f89795c353d97ed4a9671d12d0258d36d64684478d847

Download Submit
\Users\Admin\AppData\Local\Temp\nsy2178.tmp\System.dll
Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
memory/1052-63-0x0000000000000000-mapping.dmp

Download
memory/1276-54-0x0000000076C01000-0x0000000076C03000-memory.dmp

Filesize
8KB

Download
memory/1276-56-0x0000000001E90000-0x0000000001EB8000-memory.dmp

Filesize
160KB

Download
memory/1276-59-0x0000000001E90000-0x0000000001EB8000-memory.dmp

Filesize
160KB

Download
memory/1968-57-0x00000000001D5673-mapping.dmp

Download
memory/1968-60-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/1968-61-0x0000000000290000-0x00000000002B7000-memory.dmp

Filesize
156KB

Download
memory/1968-64-0x0000000000290000-0x00000000002B7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads