Analysis

  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2024 00:50

General

  • Target

    0d2bcf8a2d4c4ced43d5b6efe39aa712_JaffaCakes118.exe

  • Size

    244KB

  • MD5

    0d2bcf8a2d4c4ced43d5b6efe39aa712

  • SHA1

    9718396a27ec090f5392e8e91a8c71f05623b74a

  • SHA256

    34788994f4d7dd30f644796a869f0db7e3779999d25395b836153d108dc8a47d

  • SHA512

    80441936f51f48c9e3784d7359ede589ee9b50dca4df2d31a0606c7b455adfa4d9a2d711e836eb1895ecbe16bfd3c99f5cf3f63501a6133fb5fa792a5985af57

  • SSDEEP

    3072:wOSOrEj8LBctSm0mQec772UgH4juLAGg7oH/1XGQLChHVX0kUa:zSQEjoBTtecn4H4AE4s

Malware Config

Signatures

  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d2bcf8a2d4c4ced43d5b6efe39aa712_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d2bcf8a2d4c4ced43d5b6efe39aa712_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1612-0-0x0000000000511000-0x0000000000513000-memory.dmp

    Filesize

    8KB

  • memory/1612-1-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-3-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-4-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-5-0x0000000000511000-0x0000000000513000-memory.dmp

    Filesize

    8KB

  • memory/1612-8-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-10-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-12-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-15-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-17-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB

  • memory/1612-19-0x0000000000500000-0x0000000000541000-memory.dmp

    Filesize

    260KB