locky | 2c379a21876e829c1eeed773990eabe617d8a605b67a03b953e87dfd2c116852

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 18:18

Target

VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
Size

233KB
MD5

13f1cf097fc8c3a883bd1af16be4afad
SHA1

080261b84d573ab3757497c94ae70cbb9e014d20
SHA256

2c379a21876e829c1eeed773990eabe617d8a605b67a03b953e87dfd2c116852
SHA512

c94c5db0547949933fe86e6ee8ab9ff007d8df5155fb9eb28dea66e80e43e7babfbada288d9a542db0522fdaafc0ff2ffb17b7af3aee5e03c769d7866defb022
SSDEEP

6144:+8ImR5cnj/QdAWSTtTWylI2+Tvloy5NESJCDZ1pv2/PsD:+MR5cnj/GACfvKpOCDHC6

Score

10^/10

locky ransomware

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Suspicious use of SetThreadContext 1 IoCs

Processes:

VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

description	pid	process	target process
PID 2860 set thread context of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

description	pid	process	target process
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
PID 2860 wrote to memory of 2576	2860	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe	VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_13f1cf097fc8c3a883bd1af16be4afad.exe"
  2⤵
  PID:2576

memory/2576-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2860-0-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/2860-1-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/2860-15-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download