locky_lukitus | 3315a2d5e721d5651480de71849f677a1a8ee2d4c2d7118053f02c71fb580b23

General

Target

75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe
Size

599KB
MD5

75f0638e40cb937d9a553eb08b57d54c
SHA1

90ee61f64291bc6ae80abed380c21ce335662d72
SHA256

3315a2d5e721d5651480de71849f677a1a8ee2d4c2d7118053f02c71fb580b23
SHA512

4d837e332f1c66d971076a66b29bddf66e7e01c483598973869db0ad058ccdf3d8ee696979fa1f38d6dddf3fee3bc70ee4254a485d336738f63e2ceabb0f135c
SSDEEP

12288:XCHtHX2MoozEXPSL85ZGdVcbxdGnu+QF2O79niSCWPJxXvhFc3wGclt:XCHtHKsEXPMQYcbGnk/7FiSZPJRhRD

Score

10^/10

locky_lukitus ransomware

Malware Config

Signatures

Locky (Lukitus variant)
Variant of the Locky ransomware seen in the wild since late 2017.
ransomware locky_lukitus

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\lukitus.bmp"	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\WallpaperStyle = "0"	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\TileWallpaper = "0"	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 3292	1428	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe	111
PID 1428 wrote to memory of 3292	1428	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe	111
PID 1428 wrote to memory of 2392	1428	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe	112
PID 1428 wrote to memory of 2392	1428	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe	112
PID 1428 wrote to memory of 2392	1428	75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe"
1⤵
- Sets desktop wallpaper using registry
- Enumerates system info in registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lukitus.htm
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe"
  2⤵
  PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
1⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4340,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
1⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3412,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:1
1⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=4640,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
1⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5424,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
1⤵
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5432,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
1⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5840,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Default\lukitus-0921.htm

Filesize
8KB

MD5
8665cba47eef4342d29f5dbe8aac3ea6

SHA1
536b3da2fb0d567cedc9fe40285eaa15ceade1f4

SHA256
94e9d9b1a14c3161f47ccf426c3f891bafb53240be459f57c1d89a8f25a6bdcf

SHA512
e9db890ba79525026b9c00e4b24f738def707939060e256b18ff04c8dc6a6a68d3b1a77472cc0919fdf8086cf335e7e76fbb0aa8f5bdae478c6902abe84ae298

Download Submit
memory/1428-5-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/1428-3-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-2-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-4-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-6-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1428-0-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-7-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-8-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-12-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-14-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-16-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-1-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1428-308-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download

Analysis

Sharing