dharma | b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4

General

Target

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
Size

754KB
MD5

43d895968256c8f74db6f18a42baade7
SHA1

194b8558963cc774c8267ca9d01b9e09e317ec0a
SHA256

b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4
SHA512

02e46209c349ff6844b3b8124347751de8dd34edacccb23746b373dcdfa80ceeeee6a622540dea00ce02bddc2b5bb4aa6993cabf77e1f4cce0c82695f447f0bc
SSDEEP

12288:5ttUtThYwSVUMByWUtEM14sSSx0ZREBU0UXlS5MiyQcY88whlrTauDw9fno:5AlSxByWO4sStZR13SjyUIrTVf

Score

10^/10

dharma defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 1 IoCs

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe = "C:\\Windows\\System32\\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe"	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\desktop.ini	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System32\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

description	pid	process	target process
PID 2240 set thread context of 3420	2240	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscorlib.dll	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationClientSideProviders.resources.dll	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PenImc_cor3.dll	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Extensions.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationCore.resources.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\D3DCompiler_47_cor3.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosMedTile.scale-100.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1851_24x24x32.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\lib\deployment.config.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-24.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Camera_Capture_Loud.m4a	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-debug-l1-1-0.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\ReachFramework.resources.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Ping.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\logging.properties.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsLargeTile.scale-125.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-400_contrast-black.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.dll	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationTypes.resources.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\WindowsFormsIntegration.resources.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-150.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_altform-lightunplated.png	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Extensions.dll	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\WindowsBase.resources.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.id-4228B4FB.[[email protected]].money	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4444 vssadmin.exe

pid	process
4444	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

pid	process
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 4264 vssvc.exe
Token: SeRestorePrivilege 4264 vssvc.exe
Token: SeAuditPrivilege 4264 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	4264	vssvc.exe
Token: SeRestorePrivilege	4264	vssvc.exe
Token: SeAuditPrivilege	4264	vssvc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe43d895968256c8f74db6f18a42baade7_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2240 wrote to memory of 3420	2240	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
PID 2240 wrote to memory of 3420	2240	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
PID 2240 wrote to memory of 3420	2240	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
PID 2240 wrote to memory of 3420	2240	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
PID 3420 wrote to memory of 3208	3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	cmd.exe
PID 3420 wrote to memory of 3208	3420	43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe	cmd.exe
PID 3208 wrote to memory of 5024	3208	cmd.exe	mode.com
PID 3208 wrote to memory of 5024	3208	cmd.exe	mode.com
PID 3208 wrote to memory of 4444	3208	cmd.exe	vssadmin.exe
PID 3208 wrote to memory of 4444	3208	cmd.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\Temp\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\43d895968256c8f74db6f18a42baade7_JaffaCakes118.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3208

C:\Windows\system32\mode.com
mode con cp select=1251
4⤵
PID:5024

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4264

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-4228B4FB.[[email protected]].money
Filesize
2.9MB

MD5
612a39bec4a7a70671f9331087d9901c

SHA1
288b810d4ebc78ec3ec4d0c8be83d0373f10a731

SHA256
9ac6e86e942127a75a4be64237c6ecad9ceef50697baa2e2a97ac35a69aad360

SHA512
c3580f28e7573fc30e384709dc86feb7e06733e1999a82f7f81d6413474543686a2842ee6f14c830371d6df0210051f33dc6a8673af13f3ade1c0258c13d5ac7

Download Submit
memory/2240-0-0x0000000002A80000-0x0000000002AB3000-memory.dmp

Filesize
204KB

Download
memory/2240-1-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2240-2-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2240-3-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2240-4-0x0000000002A80000-0x0000000002AB3000-memory.dmp

Filesize
204KB

Download
memory/2240-5-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2240-23-0x0000000002A80000-0x0000000002AB3000-memory.dmp

Filesize
204KB

Download
memory/3420-422-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads