locky | 359c8b210c85133c39e48b0ad41b8a28f215045420fb061348d9773ef33b7f2a

General

Target

5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe
Size

576KB
MD5

79d57f8f54bade79046ec3848bf14642
SHA1

7f90f82dd95f688b7479501e72f06e462876f29e
SHA256

5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add
SHA512

a479858fd4a839eee155987e01f674c4e99ca0f64597a919eacfb156c24c5b4227f92d3fe13dc08e0c99cb385213bb2e6ec2c889948a14c6083f024449acdc70
SSDEEP

12288:q6GYxM5/3Wi748sx3JpXCcb6w8m8OfFSUzEC86FR/jiQSKXc:OYq5uigx7ycGpj8H8MJigc

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\ykcol.bmp"	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
544	vssadmin.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "0"	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\TileWallpaper = "0"	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1820	vssvc.exe
Token: SeRestorePrivilege	1820	vssvc.exe
Token: SeAuditPrivilege	1820	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 452	2440	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe	110
PID 2440 wrote to memory of 452	2440	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe	110
PID 2440 wrote to memory of 4056	2440	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe	111
PID 2440 wrote to memory of 4056	2440	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe	111
PID 2440 wrote to memory of 4056	2440	5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe
"C:\Users\Admin\AppData\Local\Temp\5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ykcol.htm
  2⤵
  PID:452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\5a563e7b4523310c4cacd24956ef84f0af27a3cb6457d662da1db29d48918add.exe"
  2⤵
  PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3084

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
1⤵
- Interacts with shadow copies
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5724 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1
1⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5420 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1
1⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4876 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1
1⤵
PID:820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5924 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5992 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ykcol-a0f5.htm

Filesize
8KB

MD5
7407d095d1e3aebc0df084bc3842248f

SHA1
5f7962d8b9e82e17ae99cfc43f7187fd0598f39e

SHA256
45c1d1f7e4adb081c4c5a69ffc0a828a839a2f6d68fac01276ed913cc0da77ae

SHA512
303aa267ca9fea8a5a92fb41f50d8c7a5a4baef3a222cdd1ba2e809feb6a578c918776770baa4e75f1b64fd352921703e495d5ab7add3bf69e1d97dbef7fd6ad

Download Submit
memory/2440-0-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2440-2-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2440-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2440-1-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2440-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2440-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2440-6-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2440-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2440-214-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2440-305-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing