locky | 4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876

Analysis

max time kernel
166s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/07/2022, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe
Size 239KB
Sample220712-q8f4gsfed3
SHA256 4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876
MD5 70e4f687246a47cec452122577f458be
SHA1 4b33871966fc98360918bbd5231dc7f2eb9bd3b7
SHA512 16e75542f96a8f985c1a7d3a6d012d8e0314a8b68f095217acae60c475c6de34408f8029650349536a95fdc094b9e2acbbaa256b65cc939c4025b6e7ab858594
MD5 SHA1 SHA512

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Loads dropped DLL 1 IoCs

pid	Process
4788	4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4788 set thread context of 1888	4788	4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4788	4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1888	4788	4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe	80
PID 4788 wrote to memory of 1888	4788	4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe	80
PID 4788 wrote to memory of 1888	4788	4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe	80
PID 4788 wrote to memory of 1888	4788	4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe	80

C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe
"C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe
  "C:\Users\Admin\AppData\Local\Temp\4a4de5b3e6eb0189b0ccaf6445696e1e167bcd03be5712d352dc2f96257b4876.exe"
  2⤵
  PID:1888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nssC307.tmp\System.dll
Size 11KB
SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
MD5 ca332bb753b0775d5e806e236ddcec55
SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1888-134-0x00000000001D0000-0x00000000001F7000-memory.dmp

Download

memory/1888-135-0x0000000000720000-0x0000000000747000-memory.dmp

Download

memory/1888-136-0x0000000000720000-0x0000000000747000-memory.dmp

Download

memory/4788-131-0x0000000002820000-0x000000000283E000-memory.dmp

Download

memory/4788-133-0x0000000002820000-0x000000000283E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads