Overview

overview

10

Static

static

3

75f0638e40...18.exe

windows7-x64

10

75f0638e40...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe

  • Size

    599KB

  • MD5

    75f0638e40cb937d9a553eb08b57d54c

  • SHA1

    90ee61f64291bc6ae80abed380c21ce335662d72

  • SHA256

    3315a2d5e721d5651480de71849f677a1a8ee2d4c2d7118053f02c71fb580b23

  • SHA512

    4d837e332f1c66d971076a66b29bddf66e7e01c483598973869db0ad058ccdf3d8ee696979fa1f38d6dddf3fee3bc70ee4254a485d336738f63e2ceabb0f135c

  • SSDEEP

    12288:XCHtHX2MoozEXPSL85ZGdVcbxdGnu+QF2O79niSCWPJxXvhFc3wGclt:XCHtHKsEXPMQYcbGnk/7FiSZPJRhRD

Score
10/10
locky_lukitusransomware

Malware Config

Signatures

  • Locky (Lukitus variant)

    Variant of the Locky ransomware seen in the wild since late 2017.

    ransomwarelocky_lukitus
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Enumerates system info in registry
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lukitus.htm
      2⤵
        PID:3292
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\75f0638e40cb937d9a553eb08b57d54c_JaffaCakes118.exe"
        2⤵
          PID:2392
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
        1⤵
          PID:3016
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4340,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
          1⤵
            PID:1276
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3412,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:1
            1⤵
              PID:3996
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=4640,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
              1⤵
                PID:4696
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5424,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
                1⤵
                  PID:60
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5432,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
                  1⤵
                    PID:212
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5840,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
                    1⤵
                      PID:2680

                    Network

                    MITRE ATT&CK Matrix ATT&CK v13

                    Initial Access

                    Execution

                    Persistence

                    Privilege Escalation

                    Defense Evasion

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Discovery

                    System Information Discovery

                    2
                    T1082

                    Query Registry

                    1
                    T1012

                    Lateral Movement

                    Collection

                    Exfiltration

                    Command and Control

                    Impact

                    Defacement

                    1
                    T1491

                    Resource Development

                    Reconnaissance

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Default\lukitus-0921.htm
                      Filesize

                      8KB

                      MD5

                      8665cba47eef4342d29f5dbe8aac3ea6

                      SHA1

                      536b3da2fb0d567cedc9fe40285eaa15ceade1f4

                      SHA256

                      94e9d9b1a14c3161f47ccf426c3f891bafb53240be459f57c1d89a8f25a6bdcf

                      SHA512

                      e9db890ba79525026b9c00e4b24f738def707939060e256b18ff04c8dc6a6a68d3b1a77472cc0919fdf8086cf335e7e76fbb0aa8f5bdae478c6902abe84ae298

                      Download Submit
                    • memory/1428-5-0x0000000000950000-0x0000000000951000-memory.dmp
                      Filesize

                      4KB

                      Download
                    • memory/1428-3-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-2-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-4-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-6-0x00000000001C0000-0x00000000001C1000-memory.dmp
                      Filesize

                      4KB

                      Download
                    • memory/1428-0-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-7-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-8-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-12-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-14-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-16-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-1-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download
                    • memory/1428-308-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                      Download