Analysis
-
max time kernel
67s -
max time network
110s -
platform
windows10_x64 -
resource
win10 -
submitted
25-07-2020 07:29
Static task
static1
Behavioral task
behavioral1
Sample
wyvernlocker.bin.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
wyvernlocker.bin.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
wyvernlocker.bin.exe
-
Size
15KB
-
MD5
1ae93141c7fdc45dd4784c9e427a2fdd
-
SHA1
6f7ca46e99944e32263481a319ce9bd7e15c3eae
-
SHA256
5d24babb98043b1133cc36ec6e4537e5ee515e9e9cadf709021f6961f6e40758
-
SHA512
ad874a785ce815886d7d2e14de48751b688602d38c5ebef40a32374aeb4918e6328f021f708b0201cf8c76b0de2236369d1138b898f0d0156286fcae4fa37e04
Score
8/10
Malware Config
Signatures
-
Drops file in Program Files directory 16386 IoCs
Processes:
wyvernlocker.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\gimblekeychain.3mf wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Popups\Upsell\calendar.png wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\ui-strings.js wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_cs_135x40.svg wyvernlocker.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\OneConnectAppList.targetsize-40.png wyvernlocker.bin.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages.properties wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.scale-200.png wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\OneConnectMedTile.scale-100.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-256.png wyvernlocker.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10178_20x20x32.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\by_16x11.png wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Popup_3.jpg wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare-2x.png wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\v8_context_snapshot.bin wyvernlocker.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar wyvernlocker.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\pyramid\Golden_Pharaoh_Unearned_small.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeTile.scale-200_contrast-black.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-200.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-100.png wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Sign_White@1x.png wyvernlocker.bin.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.rll wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache-Light.scale-100.png wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js wyvernlocker.bin.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotBe.snippets.ps1xml wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Awards\Assets\awards_sign_in_tile.jpg wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\Images\Generic_placeholder.png wyvernlocker.bin.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.ps1 wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css wyvernlocker.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\swear.png wyvernlocker.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd wyvernlocker.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core.jar wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-72_altform-unplated.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6124_48x48x32.png wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\AppxManifest.xml wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ui-strings.js wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\PREVIEW.GIF wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-fr\ui-strings.js wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\et.pak wyvernlocker.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-125.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1937_24x24x32.png wyvernlocker.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-400.png wyvernlocker.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\Handler@1x.png wyvernlocker.bin.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
wyvernlocker.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI wyvernlocker.bin.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini wyvernlocker.bin.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini wyvernlocker.bin.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
wyvernlocker.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\JoinResume.tiff => C:\Users\Admin\Pictures\JoinResume.tiff.xienvkdoc wyvernlocker.bin.exe File opened for modification C:\Users\Admin\Pictures\LockSubmit.tiff wyvernlocker.bin.exe File renamed C:\Users\Admin\Pictures\LockSubmit.tiff => C:\Users\Admin\Pictures\LockSubmit.tiff.xienvkdoc wyvernlocker.bin.exe File renamed C:\Users\Admin\Pictures\SearchConvertFrom.tif => C:\Users\Admin\Pictures\SearchConvertFrom.tif.xienvkdoc wyvernlocker.bin.exe File renamed C:\Users\Admin\Pictures\BlockClose.png => C:\Users\Admin\Pictures\BlockClose.png.xienvkdoc wyvernlocker.bin.exe File renamed C:\Users\Admin\Pictures\ClearOptimize.tif => C:\Users\Admin\Pictures\ClearOptimize.tif.xienvkdoc wyvernlocker.bin.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromSkip.tiff wyvernlocker.bin.exe File opened for modification C:\Users\Admin\Pictures\JoinResume.tiff wyvernlocker.bin.exe File renamed C:\Users\Admin\Pictures\ConvertFromSkip.tiff => C:\Users\Admin\Pictures\ConvertFromSkip.tiff.xienvkdoc wyvernlocker.bin.exe File renamed C:\Users\Admin\Pictures\InvokeStep.tif => C:\Users\Admin\Pictures\InvokeStep.tif.xienvkdoc wyvernlocker.bin.exe