locky | 60f634413cb2e27303ef7854667c967ae1253266bc19fc3331943e82d38fccf3 | Triage

Submit
Reports

Overview

overview

Static

static

60f634413c...f3.dll

windows7-x64

60f634413c...f3.dll

windows10-2004-x64

Sharing

General

Target

60f634413cb2e27303ef7854667c967ae1253266bc19fc3331943e82d38fccf3
Size

110KB
Sample

220730-2k1c1abch6
MD5

7e65a93663960c7c40c36953cbfb5f6f
SHA1

cd8b22a6c8dc5a3b9dd795824aa0b99359e63d94
SHA256

60f634413cb2e27303ef7854667c967ae1253266bc19fc3331943e82d38fccf3
SHA512

0b674a73f5fbc4be14d951f3aadbed617310a2b21aa08489bab7bd07d57b1bcd812e411070e569af7fa5d3383264178c9e60dc03238a9d668b4464db8ed69782

Score

10^/10

locky persistence ransomware

Static task

static1

Behavioral task

behavioral1

Sample

60f634413cb2e27303ef7854667c967ae1253266bc19fc3331943e82d38fccf3.dll

Resource

win7-20220715-en

locky ransomware

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

60f634413cb2e27303ef7854667c967ae1253266bc19fc3331943e82d38fccf3.dll

Resource

win10v2004-20220721-en

locky persistence ransomware

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  60f634413cb2e27303ef7854667c967ae1253266bc19fc3331943e82d38fccf3
- Size
  
  110KB
- MD5
  
  7e65a93663960c7c40c36953cbfb5f6f
- SHA1
  
  cd8b22a6c8dc5a3b9dd795824aa0b99359e63d94
- SHA256
  
  60f634413cb2e27303ef7854667c967ae1253266bc19fc3331943e82d38fccf3
- SHA512
  
  0b674a73f5fbc4be14d951f3aadbed617310a2b21aa08489bab7bd07d57b1bcd812e411070e569af7fa5d3383264178c9e60dc03238a9d668b4464db8ed69782
Score

10^/10

locky ransomware persistence
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

lockyransomware

behavioral2

lockypersistenceransomware

© 2018-2024

Terms | Privacy