locky_lukitus | 4b6ffe7c8bb710c3b3e7eef0a79dae32ec9c3a4a3684d252caff3f8a33bd8856 | Triage

Sharing

General

Target

c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118
Size

595KB
Sample

240827-sdenaawepf
MD5

c537ad6b878730ba88834bdb361e3bd7
SHA1

f6568b081dd562bcee939c9f691184b37ac10046
SHA256

4b6ffe7c8bb710c3b3e7eef0a79dae32ec9c3a4a3684d252caff3f8a33bd8856
SHA512

1e3b631f5178084ed49c5d22513c67aa6f8291aeb7a513f5aaeca44c83bd0bd0efb02c0d67b21e8829fe277c1befed01ae5e4bb5dca4befd2a28069e20451f05
SSDEEP

12288:/mDxN5Hef7wWHX+IuNEFVqhJuWYI17c8Z7zo1N92:YN5+f7t3cEFVq5Y0wu7zoI

Score

10^/10

locky_lukitus defense_evasion discovery execution impact persistence ransomware

Malware Config

Targets

- Target
  
  c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118
- Size
  
  595KB
- MD5
  
  c537ad6b878730ba88834bdb361e3bd7
- SHA1
  
  f6568b081dd562bcee939c9f691184b37ac10046
- SHA256
  
  4b6ffe7c8bb710c3b3e7eef0a79dae32ec9c3a4a3684d252caff3f8a33bd8856
- SHA512
  
  1e3b631f5178084ed49c5d22513c67aa6f8291aeb7a513f5aaeca44c83bd0bd0efb02c0d67b21e8829fe277c1befed01ae5e4bb5dca4befd2a28069e20451f05
- SSDEEP
  
  12288:/mDxN5Hef7wWHX+IuNEFVqhJuWYI17c8Z7zo1N92:YN5+f7t3cEFVq5Y0wu7zoI
Score

10^/10

locky_lukitus defense_evasion discovery execution impact persistence ransomware
- Locky (Lukitus variant)
  Variant of the Locky ransomware seen in the wild since late 2017.
  ransomware locky_lukitus
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Deletes itself
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

locky_lukitusdefense_evasiondiscoveryexecutionimpactpersistenceransomware

behavioral2

locky_lukitusdefense_evasiondiscoveryexecutionimpactpersistenceransomware