General
-
Target
43d895968256c8f74db6f18a42baade7_JaffaCakes118
-
Size
754KB
-
Sample
240515-a7eahahd26
-
MD5
43d895968256c8f74db6f18a42baade7
-
SHA1
194b8558963cc774c8267ca9d01b9e09e317ec0a
-
SHA256
b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4
-
SHA512
02e46209c349ff6844b3b8124347751de8dd34edacccb23746b373dcdfa80ceeeee6a622540dea00ce02bddc2b5bb4aa6993cabf77e1f4cce0c82695f447f0bc
-
SSDEEP
12288:5ttUtThYwSVUMByWUtEM14sSSx0ZREBU0UXlS5MiyQcY88whlrTauDw9fno:5AlSxByWO4sStZR13SjyUIrTVf
Static task
static1
Behavioral task
behavioral1
Sample
43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Targets
-
-
Target
43d895968256c8f74db6f18a42baade7_JaffaCakes118
-
Size
754KB
-
MD5
43d895968256c8f74db6f18a42baade7
-
SHA1
194b8558963cc774c8267ca9d01b9e09e317ec0a
-
SHA256
b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4
-
SHA512
02e46209c349ff6844b3b8124347751de8dd34edacccb23746b373dcdfa80ceeeee6a622540dea00ce02bddc2b5bb4aa6993cabf77e1f4cce0c82695f447f0bc
-
SSDEEP
12288:5ttUtThYwSVUMByWUtEM14sSSx0ZREBU0UXlS5MiyQcY88whlrTauDw9fno:5AlSxByWO4sStZR13SjyUIrTVf
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-