86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

Resubmissions

03/05/2023, 11:56

230503-n4bxvsef29 10

03/05/2023, 11:43

230503-nvmb8sgd7t 8

Analysis

max time kernel
53s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/05/2023, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$uckyLocker.exe
Size

414KB
MD5

c850f942ccf6e45230169cc4bd9eb5c8
SHA1

51c647e2b150e781bd1910cac4061a2cee1daf89
SHA256

86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
SHA512

2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9
SSDEEP

6144:Av+lDAAB6fm00rx/Qdd1QkfRLT+vLtls6LEmynPsVpw/pcPk19:RdAAB6Mk1HfRLqzPlLEmynPsVpwBT

Score

8^/10

evasion ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1492	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	taskmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1492	844	cmd.exe	31
PID 844 wrote to memory of 1492	844	cmd.exe	31
PID 844 wrote to memory of 1492	844	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\$uckyLocker.exe
"C:\Users\Admin\AppData\Local\Temp\$uckyLocker.exe"
1⤵
- Sets desktop wallpaper using registry
PID:1088

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of FindShellTrayWindow
PID:1644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact