Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
14-10-2024 21:45
General
-
Target
445576de32aa864e4f358fd9041af3e5_JaffaCakes118.exe
-
Size
245KB
-
MD5
445576de32aa864e4f358fd9041af3e5
-
SHA1
5b6d23c5d5fdb0c88ad9e43d5581800fabef9014
-
SHA256
81c43e493f87f6f95d9935e2d20835857f2ebbc1e16369e45ff48fa9c7523805
-
SHA512
84d694ea7a120abea1bfdc5e3530180f250ac28e59267e870f943c6041ec308aec9f8f9c32ebd1372df56c4a493571ffc5fac8d31c4b4e875ac76387a59d21bf
-
SSDEEP
3072:DvqsF78bGTGaPQjEf4luLAGg7oH/lb6y9akTpjnmCAwcn0ekUEj:DvqsF7KGtcg4eAy9asNMw
Score
10/10
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\445576de32aa864e4f358fd9041af3e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\445576de32aa864e4f358fd9041af3e5_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
8KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB