Analysis
-
max time kernel
515s -
max time network
513s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.7z
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
General
-
Target
bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.7z
-
Size
119KB
-
MD5
da6ca7ee9669864f267d835c194d1192
-
SHA1
672baeab0fbbc1ea062112e45bca08d5956ce9c7
-
SHA256
b18b392a91a270fa3455c68dc3f9332938ae35fe2d419e4fa114974267b29198
-
SHA512
f278ab553b23d08658bc4ee3d289362a9f960313b120be2fcd397b59d3c6ce807bb8bc1c1434518cf2d8dc8a4a9edb64550d9278e0d7e8b473d15e37a17ccaab
-
SSDEEP
3072:fJyaCVbqBxwGZWpwvo646hB4ulrrC+t2JPawre9MCa6F/h:QaCIL0pwvJ46/r2AhwWMC9/
Score
10/10
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky family
-
Executes dropped EXE 2 IoCs
pid Process 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 1124 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2664 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2792 7zFM.exe Token: 35 2792 7zFM.exe Token: SeSecurityPrivilege 2792 7zFM.exe Token: SeDebugPrivilege 2664 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2792 7zFM.exe 2792 7zFM.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe 2664 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1124 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 34 PID 2576 wrote to memory of 1124 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 34 PID 2576 wrote to memory of 1124 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 34 PID 2576 wrote to memory of 1124 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 34 PID 2576 wrote to memory of 2980 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 35 PID 2576 wrote to memory of 2980 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 35 PID 2576 wrote to memory of 2980 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 35 PID 2576 wrote to memory of 2980 2576 bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe 35
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792
-
C:\Users\Admin\Desktop\bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe"C:\Users\Admin\Desktop\bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1124
-
-
C:\Windows\system32\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys823A.tmp"2⤵PID:2980
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5b06d9dd17c69ed2ae75d9e40b2631b42
SHA1b606aaa402bfe4a15ef80165e964d384f25564e4
SHA256bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
SHA5128e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c