Overview

overview

10

Static

static

3

aca7ca6f09...18.exe

windows7-x64

7

aca7ca6f09...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aca7ca6f090aba613f6a701f0b2bac1c_JaffaCakes118

  • Size

    202KB

  • Sample

    241128-rvaj8awlel

  • MD5

    aca7ca6f090aba613f6a701f0b2bac1c

  • SHA1

    7d889d00e5cf9a09800faa450fcbfa17eadc5664

  • SHA256

    749e8c87bc157a7dc7a9c7427c41dbcd1f087250914caedd3aaa93982af1c433

  • SHA512

    567f6c90c1d9da328afbe3d8c1fb452135e592e13daf59b78f6855c7caa00cc98d5a76ac5707583907f6391dd8d940bfe1b1c187c9448b635414307ae87abf4e

  • SSDEEP

    6144:ZAU479KlI4imKWcPg62UgzMha1UBR+B3F:Wl96WmlcPg62tj10

Score
10/10
lockydefense_evasiondiscoveryransomware

Malware Config

Targets

    • Target

      aca7ca6f090aba613f6a701f0b2bac1c_JaffaCakes118

    • Size

      202KB

    • MD5

      aca7ca6f090aba613f6a701f0b2bac1c

    • SHA1

      7d889d00e5cf9a09800faa450fcbfa17eadc5664

    • SHA256

      749e8c87bc157a7dc7a9c7427c41dbcd1f087250914caedd3aaa93982af1c433

    • SHA512

      567f6c90c1d9da328afbe3d8c1fb452135e592e13daf59b78f6855c7caa00cc98d5a76ac5707583907f6391dd8d940bfe1b1c187c9448b635414307ae87abf4e

    • SSDEEP

      6144:ZAU479KlI4imKWcPg62UgzMha1UBR+B3F:Wl96WmlcPg62tj10

    Score
    10/10
    discoverylockydefense_evasionransomware

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Locky family

      locky

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks