Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-11-2024 07:43
General
-
Target
8445262184311d4eec2ec478603b6ea3_JaffaCakes118.exe
-
Size
205KB
-
MD5
8445262184311d4eec2ec478603b6ea3
-
SHA1
a8fa1d91e35c0aa2ca691a8b0717b28150e568be
-
SHA256
eff5556dc1c2c20eeceb56adbf120cf95428bc178380627a044f9919bcae1176
-
SHA512
914535fa9ffd285ea7268ba5339b1bc2ced7f3cbbcea0dab2da2f77759a32a04f67a4e47f1245224e2ab4770df10f53254ae84d91da5ea77e6bb5f3bf4dbe377
-
SSDEEP
3072:eF9vjmT2RIlYO9T4T+9Yek/Y2s41ecuLAGE77H/hLIcPaThhpc6:A9KT2az8cLkQ4g4JIX
Score
10/10
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8445262184311d4eec2ec478603b6ea3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8445262184311d4eec2ec478603b6ea3_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB