Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe
-
Size
91KB
-
MD5
91d8ab08a37f9c26a743380677aa200d
-
SHA1
e64e4617c8bdb5c6c3ae30e73d8211400651c8ba
-
SHA256
d0431537537c9c73f5a1b90b46b560cac4be82feb5ac14d47163a9f4b4fa1a41
-
SHA512
72d9ef9e26afa70ffe797a79fe3840e6b45d8e4ce863e4ea4eeda5b990f1e692c859addad49fdf7dfb41ad737cee88892caede348bdee13dc98fa5f8f57f7864
-
SSDEEP
1536:lf0kZhST9p9VTME6Pd+u7RVvGlhRuqeyyD+bNaI+/x8SHO532QhqyIucYqRbwKGc:lflhk9VwZP7RxUKXy/Z8x8oAsucZtz
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky family
-
Executes dropped EXE 1 IoCs
pid Process 1768 svchost.exe -
Program crash 4 IoCs
pid pid_target Process procid_target 1840 4740 WerFault.exe 84 3440 4740 WerFault.exe 84 3900 4740 WerFault.exe 84 3896 4740 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4740 wrote to memory of 1768 4740 91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe 94 PID 4740 wrote to memory of 1768 4740 91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe 94 PID 4740 wrote to memory of 1768 4740 91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91d8ab08a37f9c26a743380677aa200d_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 4402⤵
- Program crash
PID:1840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 4602⤵
- Program crash
PID:3440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 4682⤵
- Program crash
PID:3900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 5042⤵
- Program crash
PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4740 -ip 47401⤵PID:4232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4740 -ip 47401⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4740 -ip 47401⤵PID:548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4740 -ip 47401⤵PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD54e4a8812b80c8542a3095a53c29f5441
SHA16218bd4eba6d91007d8b8c32a040194ec123f5b6
SHA2562cbf3ac4f304fa711e23d6a8a762451b7b06550d56b7bd688d4c6d1bee9984db
SHA5125bfd0bb53db5e4c6abe8dbed61a14244e107061bd29319a30e6dc8ee1c87f9d88ead7c843494a0b927d32efbf95e9510eb4d67df6bc3f4c849c80798523a071b