locky_lukitus | 3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03/07/2022, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe
Size

606KB
MD5

91a61e3be9cc7251972f6ee8d4836cb4
SHA1

f78c091a623c605e74511dd80d1a48376c2c4145
SHA256

3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca
SHA512

aa773715d5333b7fc20517e8449f5fd4d54781d6d175ce7d0fbaea9b862ac6aeca8835254a37c8edccaf584d3b56d15a79d20fe296f885d2c1c300cd5487da60

Score

10^/10

locky_lukitus persistence ransomware suricata

Malware Config

Signatures

Locky (Lukitus variant)
Variant of the Locky ransomware seen in the wild since late 2017.
ransomware locky_lukitus
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata: ET MALWARE Locky CnC checkin Nov 21 M2
suricata

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\InvokeUnpublish.tiff	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\lukitus.bmp"	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7d267596-ef07-4fce-b338-5a024e15cdeb.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220703032528.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\WallpaperStyle = "0"	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\TileWallpaper = "0"	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3388	msedge.exe
3388	msedge.exe
4636	identity_helper.exe
4636	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3388	1792	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe	87
PID 1792 wrote to memory of 3388	1792	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe	87
PID 1792 wrote to memory of 3136	1792	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe	88
PID 1792 wrote to memory of 3136	1792	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe	88
PID 1792 wrote to memory of 3136	1792	3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe	88
PID 3388 wrote to memory of 3008	3388	msedge.exe	89
PID 3388 wrote to memory of 3008	3388	msedge.exe	89
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 1828	3388	msedge.exe	92
PID 3388 wrote to memory of 3892	3388	msedge.exe	93
PID 3388 wrote to memory of 3892	3388	msedge.exe	93
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94
PID 3388 wrote to memory of 5076	3388	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe
"C:\Users\Admin\AppData\Local\Temp\3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lukitus.htm
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe109d46f8,0x7ffe109d4708,0x7ffe109d4718
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff791595460,0x7ff791595470,0x7ff791595480
      4⤵
      PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6002640682835238257,7394907514840529066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\3d653771933422f9a081ea122865da76edde83cdeb41b8b8e377833e75e21aca.exe"
  2⤵
  PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\lukitus.htm

Filesize
9KB

MD5
edf32515992cafb06bf4bff046ede24e

SHA1
a653879a0cfbed20b93490a5d927ca0120a3869d

SHA256
59d863aeca598b3a377801beb18f1c98fdcb2c35b9b54a9de5ec4d4f4b0ac006

SHA512
800d110e4746f26c9fdebb8ae25bf13618375cce66de15e7240f2761fd2254415e7c413acab584781942847c51952cada25b4e0f27144d423ea22c2142fbe072

Download Submit
memory/1792-132-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/1792-137-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/1792-130-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/1792-133-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/1792-131-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download