Overview

overview

10

Static

static

3

230406-bzj2fsaf74.exe

windows7-x64

10

230406-bzj2fsaf74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    230406-bzj2fsaf74

  • Size

    639KB

  • Sample

    240320-l5q23aeb82

  • MD5

    3c0447a8e05bc9ed43128ed22c22e23a

  • SHA1

    0bf74262d4f57a3461088e1d96045ebbdeb43c21

  • SHA256

    59ec54fb9b1d3415b54558977e3640b81bb3ebebdb61af3fc772e308c6b8eb3a

  • SHA512

    f4ec59d7445ceabf7fe8fcd8be7752b5ae6db4a68bcf53d73419d515131f86c7eb8893999c9c60569f2b4f8fb27f5c1457c3177476c4dad6489fb15591c9fa44

  • SSDEEP

    12288:2jZfZfZfZfZfZfZOZ2XsHUKwbNWuTncBxPMRS8SUC9H4jlNEz9vBiptAE43/:2jZfZfZfZfZfZfZOZ2XsHUK8ni0U8SU0

Score
10/10
lockyransomware

Malware Config

Targets

    • Target

      230406-bzj2fsaf74

    • Size

      639KB

    • MD5

      3c0447a8e05bc9ed43128ed22c22e23a

    • SHA1

      0bf74262d4f57a3461088e1d96045ebbdeb43c21

    • SHA256

      59ec54fb9b1d3415b54558977e3640b81bb3ebebdb61af3fc772e308c6b8eb3a

    • SHA512

      f4ec59d7445ceabf7fe8fcd8be7752b5ae6db4a68bcf53d73419d515131f86c7eb8893999c9c60569f2b4f8fb27f5c1457c3177476c4dad6489fb15591c9fa44

    • SSDEEP

      12288:2jZfZfZfZfZfZfZOZ2XsHUKwbNWuTncBxPMRS8SUC9H4jlNEz9vBiptAE43/:2jZfZfZfZfZfZfZOZ2XsHUK8ni0U8SU0

    Score
    10/10
    lockyransomware

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes itself

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks