Overview

overview

10

Static

static

3

0b40a2fff6...18.exe

windows7-x64

10

0b40a2fff6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b40a2fff66d3c7f728b2d0e9ae861a6_JaffaCakes118

  • Size

    654KB

  • Sample

    240501-g4rvraca86

  • MD5

    0b40a2fff66d3c7f728b2d0e9ae861a6

  • SHA1

    91f89d87f92ba4f96d16a96c35e56e039adf6979

  • SHA256

    117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2

  • SHA512

    dec02943bb4dfae04c0fcce7cb644aa60277f33cd4747270b4a2d3feb5ca53cf6a5d037eb618bc4c27e3ea266089a2fa8b0ae1fb68f9180fb9b4a15522834c5a

  • SSDEEP

    12288:yz9jX9Eh/41Vfbtp/nZOKwXui/07zrwIOxbvnFbhs68/NimxAOWD:yz9jX9EhifbtpPZ+5/0jwIOBnqFJHWD

Score
10/10
locky_lukituspersistenceransomware

Malware Config

Targets

    • Target

      0b40a2fff66d3c7f728b2d0e9ae861a6_JaffaCakes118

    • Size

      654KB

    • MD5

      0b40a2fff66d3c7f728b2d0e9ae861a6

    • SHA1

      91f89d87f92ba4f96d16a96c35e56e039adf6979

    • SHA256

      117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2

    • SHA512

      dec02943bb4dfae04c0fcce7cb644aa60277f33cd4747270b4a2d3feb5ca53cf6a5d037eb618bc4c27e3ea266089a2fa8b0ae1fb68f9180fb9b4a15522834c5a

    • SSDEEP

      12288:yz9jX9Eh/41Vfbtp/nZOKwXui/07zrwIOxbvnFbhs68/NimxAOWD:yz9jX9EhifbtpPZ+5/0jwIOBnqFJHWD

    Score
    10/10
    locky_lukituspersistenceransomware

    • Locky (Lukitus variant)

      Variant of the Locky ransomware seen in the wild since late 2017.

      ransomwarelocky_lukitus

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks