Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10-05-2024 07:55
General
-
Target
2e1c9df86798281f7bd72a4ec576c89a_JaffaCakes118.exe
-
Size
371KB
-
MD5
2e1c9df86798281f7bd72a4ec576c89a
-
SHA1
63ed5d5ebc6cfeabc4159cd151494101708dd154
-
SHA256
83e8b72b3f30b2f74ddc49f2e7e510a1b6e2df2d25f2b12b359094858a4562e8
-
SHA512
46f30ab59a5e079975beb7199d68b9f283a052f28ebb9bd0b1c03961437c0bfdf6050f157faa252968875e234080535f7261b96f7c8b0d622d1b58ea1ab754ca
-
SSDEEP
6144:QgS/jqoVV6VCxkY4THjzgcwzI3eJv/2dg/c1NfR4aAfmKjjjjjjjjjjjj72+ai/:Qz/jhVV6VekY4DYz6svOWk1NfirfjjjP
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e1c9df86798281f7bd72a4ec576c89a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e1c9df86798281f7bd72a4ec576c89a_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e1c9df86798281f7bd72a4ec576c89a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\2e1c9df86798281f7bd72a4ec576c89a_JaffaCakes118.exe2⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2e1c9df86798281f7bd72a4ec576c89a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\2e1c9df86798281f7bd72a4ec576c89a_JaffaCakes118.exe3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x514 0x4dc1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5cb99a2cbfea99af3c59722b9c58a113e
SHA1e3e36b9670c7ce9f76f16ecda8c53469a9790fd4
SHA2561f8199cf1254e5d864ec92efac48bb2da7932c5259e44197668de855fd9934f6
SHA51285583b5d9e37117b643eb20848d6dbcf7735a90d934e130039699175deed652b95c2d594a624f67f5886c4ce3ef958841289e0531beac3ac6659b49f2b461659
-
Filesize
3.8MB
MD53474a3c47e92793a5fa57b263a122519
SHA13830b0c0b1321cf1ce4f16fa3527812ae2b2ab07
SHA256f05f409f94cc354aeceb2535d847fc4edd4938ed020f97117d61109bfa4d6278
SHA512f218b1d413ff80e3909a43a75d430d02eb760eb8ad5c6414991cc0fd49f8b8ca1ab8c9cd5019a92d1a7fc4652402dbb836947dd37458f74de8123ba1f24adf05
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
392KB
-
Filesize
4KB
-
Filesize
392KB
-
Filesize
156KB
-
Filesize
528KB
-
Filesize
4KB
-
Filesize
528KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
392KB
-
Filesize
156KB
