Analysis
-
max time kernel
189s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
13-07-2022 14:54
General
-
Target
21a0201874af80436dc0a36e5cbaf7da9b75217b3e39b712f3850729cf47deb6.exe
-
Size
372KB
-
MD5
e3b3e285390c0e2f7d04bd040bec790d
-
SHA1
dbee71535e9f1fb23b3f01e25989d22d51237e68
-
SHA256
21a0201874af80436dc0a36e5cbaf7da9b75217b3e39b712f3850729cf47deb6
-
SHA512
6156a6b0ff4f41c823cba68a4596676e357ceb5b8c0848c2828a72321dbc2a731d9ae8f1a417fe27aef7de0080001ad3f77b3809b64a93c610ae99f95b35f5be
Score
10/10
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21a0201874af80436dc0a36e5cbaf7da9b75217b3e39b712f3850729cf47deb6.exe"C:\Users\Admin\AppData\Local\Temp\21a0201874af80436dc0a36e5cbaf7da9b75217b3e39b712f3850729cf47deb6.exe"1⤵
- Modifies extensions of user files
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
392KB
-
Filesize
156KB
-
Filesize
156KB