locky | df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03/07/2022, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
Size 623KB
Sample220703-l2mkgaeedr
SHA256 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567
MD5 c24a08bfeb09c9842b8e6578d7b0b721
SHA1 937a77b8ad27217b346922cb5513458542e3d390
SHA512 42717c37604b41fff2bae91a22037f0e2b1d3514a8305d672595930f331a6a998d1a88741585413977ee81cd59ab155faf19ae654d229dc0256e30d71b222799
MD5 SHA1 SHA512

Score

10^/10

locky persistence ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\ShowHide.tiff	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\opt321 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe"	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\asasin.bmp"	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9c7ee64c-60e3-4635-9e79-39c1142689b4.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220703120433.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\Desktop\WallpaperStyle = "0"	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\Desktop\TileWallpaper = "0"	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
Token: SeTakeOwnershipPrivilege	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
Token: SeBackupPrivilege	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
Token: SeRestorePrivilege	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1688	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe	89
PID 2840 wrote to memory of 1688	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe	89
PID 2840 wrote to memory of 2352	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe	90
PID 2840 wrote to memory of 2352	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe	90
PID 2840 wrote to memory of 2352	2840	df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe	90
PID 1688 wrote to memory of 3600	1688	msedge.exe	92
PID 1688 wrote to memory of 3600	1688	msedge.exe	92
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 5040	1688	msedge.exe	95
PID 1688 wrote to memory of 1720	1688	msedge.exe	96
PID 1688 wrote to memory of 1720	1688	msedge.exe	96
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97
PID 1688 wrote to memory of 1800	1688	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
"C:\Users\Admin\AppData\Local\Temp\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\asasin.htm
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec4f546f8,0x7ffec4f54708,0x7ffec4f54718
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2876 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3108 /prefetch:8
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2376,18158750586118105353,8102971384251814050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6cea45460,0x7ff6cea45470,0x7ff6cea45480
      4⤵
      PID:4072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe"
  2⤵
  PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

asasin.htm

Path C:\Users\Admin\Desktop\asasin.htm
Size 8KB
SHA256 1cfc524b14bbb817660b56892629b3ae84d5dff3f75d5f2c686ad43f1b3b78d0
MD5 3b8b11e4e0af2ecf6ff41267b4565c3b
SHA1 5ab0f276a4149ef2854f56083590a123f7b73c95
SHA512 b54ce7c8de4c58c7cb75beb2c2ffbe33abbe2448c4d0ffe32e3a86ac138a6ff5e38a9925bee406cb709fe3b3b6c1d5ea7d9d5247a28c9d8c2da173ba668481ce
SSDEEP 96:g6z08XV2fh2YKvWdai8VZA7LoBkEoM7NvbSaDtl6+0TvPSQZocFpCu:tzJGNa2LckcSe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2840-134-0x0000000000400000-0x00000000004A2C94-memory.dmp

Download

memory/2840-137-0x0000000000400000-0x00000000004A2C94-memory.dmp

Download

memory/2840-130-0x0000000000400000-0x00000000004A2C94-memory.dmp

Download

memory/2840-132-0x0000000000400000-0x00000000004A2C94-memory.dmp

Download

memory/2840-131-0x0000000000400000-0x0000000000489000-memory.dmp

Download