locky | 0bb97b1adbcab84e7b9e98d2d5ba7d7f5b204dafdf2458a7e07f279f0a284c2e | Triage

Submit
Reports

Overview

overview

Static

static

3

a804d5b261...18.exe

windows7-x64

a804d5b261...18.exe

windows10-2004-x64

Sharing

General

Target

a804d5b2613145c9aaad7b3b43eea868_JaffaCakes118
Size

590KB
Sample

240614-e7qezsygrl
MD5

a804d5b2613145c9aaad7b3b43eea868
SHA1

5bd91a4df91c139019dba734d9be2cab74a38d0b
SHA256

0bb97b1adbcab84e7b9e98d2d5ba7d7f5b204dafdf2458a7e07f279f0a284c2e
SHA512

570e687dc4eb4a66cea6543b80cc57092cdf3cacd86fc8493a6df10f7e2411fe895971bcee8ce87bf46f5b7a438c21d66f0e9a03ac936c780fc16dd7c7922bc6
SSDEEP

12288:TJ6wdOcYExLY0ebcIZ3pxCU5/2jEa95pY0Er4L1wD88P5DmWmeyOp:TJRLe0Mco3pxCU5/2jEafpVe4L1C88xl

Score

10^/10

locky defense_evasion execution impact ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a804d5b2613145c9aaad7b3b43eea868_JaffaCakes118.exe

Resource

win7-20240221-en

locky defense_evasion execution impact ransomware

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

a804d5b2613145c9aaad7b3b43eea868_JaffaCakes118.exe

Resource

win10v2004-20240508-en

locky defense_evasion execution impact ransomware

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  a804d5b2613145c9aaad7b3b43eea868_JaffaCakes118
- Size
  
  590KB
- MD5
  
  a804d5b2613145c9aaad7b3b43eea868
- SHA1
  
  5bd91a4df91c139019dba734d9be2cab74a38d0b
- SHA256
  
  0bb97b1adbcab84e7b9e98d2d5ba7d7f5b204dafdf2458a7e07f279f0a284c2e
- SHA512
  
  570e687dc4eb4a66cea6543b80cc57092cdf3cacd86fc8493a6df10f7e2411fe895971bcee8ce87bf46f5b7a438c21d66f0e9a03ac936c780fc16dd7c7922bc6
- SSDEEP
  
  12288:TJ6wdOcYExLY0ebcIZ3pxCU5/2jEa95pY0Er4L1wD88P5DmWmeyOp:TJRLe0Mco3pxCU5/2jEafpVe4L1C88xl
Score

10^/10

locky defense_evasion execution impact ransomware
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Deletes itself
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

lockydefense_evasionexecutionimpactransomware

behavioral2

lockydefense_evasionexecutionimpactransomware

© 2018-2024

Terms | Privacy