locky | ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6

Analysis

max time kernel
253s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 22:30

Target

ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
Size

217KB
MD5

91c17565508fc5b288d467109e3aef48
SHA1

cac9d66842779bd61ebf4592c7e52862bc8c9347
SHA256

ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6
SHA512

ba5e78bbc02e193422546291878796f4e10147616c64c42d9a5ee202cb558971d1b42276c5ef799671be0e19b7d862f672ba9b4e704e80576bcebbc4dc3ff5f6
SSDEEP

3072:NFvbdafaNL5WMg5ZMRQrZ5eT+UOtnDNoGMxCl7zjfJX115BymGuDLhGEyseRR8Ti:NFvbgg5WWQ9a+tVMC7l11bLhZeYTTsd

Score

10^/10

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/772-54-0x0000000001370000-0x000000000139C000-memory.dmp	upx
behavioral1/memory/772-55-0x0000000001370000-0x000000000139C000-memory.dmp	upx
behavioral1/memory/772-68-0x0000000001370000-0x000000000139C000-memory.dmp	upx
behavioral1/memory/588-71-0x0000000001370000-0x000000000139C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 772 set thread context of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27
PID 772 wrote to memory of 588	772	ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe	27

C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
"C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe
  "C:\Users\Admin\AppData\Local\Temp\ae11a076703360859693b6c2a747c64e078f65a071cad3b2f9cf588779f22ca6.exe"
  2⤵
  PID:588

memory/588-66-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-59-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-75-0x0000000000200000-0x0000000000227000-memory.dmp

Filesize
156KB

Download
memory/588-57-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-74-0x0000000000200000-0x0000000000227000-memory.dmp

Filesize
156KB

Download
memory/588-61-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-63-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-56-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-73-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-65-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/588-70-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/588-71-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download
memory/588-72-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/772-55-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download
memory/772-68-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download
memory/772-54-0x0000000001370000-0x000000000139C000-memory.dmp

Filesize
176KB

Download