Overview

overview

9

Static

static

3

70b0fe3702...18.exe

windows7-x64

9

70b0fe3702...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 03:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70b0fe3702cbab6ab0c09a775fd6b539_JaffaCakes118.exe

  • Size

    796KB

  • MD5

    70b0fe3702cbab6ab0c09a775fd6b539

  • SHA1

    6b99372b8cc4ceb8ef678c74653e1471f69bc53f

  • SHA256

    5d8a701110d58ab7c1aa8bae6bc9d5358b8cd508115891320e6af6c68f3bbd74

  • SHA512

    8cbbfe51f93de5c8a075c7a031867a2f5e7b7681aff709b89008f276c9aa5fe74e3fc6865a0fc28550d3a2ec9892de3c5539dfd9b06ab938dcc2ed2e1cc3fd8c

  • SSDEEP

    12288:B6bzpTWdzHkaPqtzDQmSKebtX+74EXuJpZFuk+2YeEbv0BP78B:B6h9hzDQnE8SxeEb0Bg

Score
9/10
daveransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (8017) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Dave packer 1 IoCs

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

    dave
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 46 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\70b0fe3702cbab6ab0c09a775fd6b539_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\70b0fe3702cbab6ab0c09a775fd6b539_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FCB38AC8-5BF2-452F-A0B4-74358AF58331}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FCB38AC8-5BF2-452F-A0B4-74358AF58331}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CF317DE3-BF08-4258-88F3-B0A6BE6FF3DC}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CF317DE3-BF08-4258-88F3-B0A6BE6FF3DC}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2632
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E1A2FE1-97E7-4197-AAE3-8A4DC402BCF8}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E1A2FE1-97E7-4197-AAE3-8A4DC402BCF8}'" delete
        3⤵
          PID:2860
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7E2111EF-62A0-462A-942F-4D77FC57EBA7}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7E2111EF-62A0-462A-942F-4D77FC57EBA7}'" delete
          3⤵
            PID:2380
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3912F70D-A99E-4F55-98AA-43C072C75BF1}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3912F70D-A99E-4F55-98AA-43C072C75BF1}'" delete
            3⤵
              PID:1856
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{34D7511E-8275-4DF8-BCF5-B1DA649EF546}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:288
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{34D7511E-8275-4DF8-BCF5-B1DA649EF546}'" delete
              3⤵
                PID:2016
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CE92E214-5D12-40F6-AC80-823310FFDFB7}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1908
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CE92E214-5D12-40F6-AC80-823310FFDFB7}'" delete
                3⤵
                  PID:2680
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{551CD9D2-11CB-4C6F-8ADC-3D3928EBC7C3}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1500
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{551CD9D2-11CB-4C6F-8ADC-3D3928EBC7C3}'" delete
                  3⤵
                    PID:1564
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{858631E3-F88B-4FEC-A74B-04A70E74F805}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2240
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{858631E3-F88B-4FEC-A74B-04A70E74F805}'" delete
                    3⤵
                      PID:2216
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7E57876-9FE2-449C-9015-DB7EBB30A5D0}'" delete
                    2⤵
                      PID:2024
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7E57876-9FE2-449C-9015-DB7EBB30A5D0}'" delete
                        3⤵
                          PID:2056
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CA8D1F8-B473-4500-B83A-B8635829D287}'" delete
                        2⤵
                          PID:2012
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CA8D1F8-B473-4500-B83A-B8635829D287}'" delete
                            3⤵
                              PID:2020
                          • C:\Windows\system32\cmd.exe
                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8D7DA3F3-8F82-4D4A-BFCB-C1C06F1F726E}'" delete
                            2⤵
                              PID:532
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8D7DA3F3-8F82-4D4A-BFCB-C1C06F1F726E}'" delete
                                3⤵
                                  PID:772
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{058745A6-C542-4EEF-9279-65DB499EDA79}'" delete
                                2⤵
                                  PID:1616
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{058745A6-C542-4EEF-9279-65DB499EDA79}'" delete
                                    3⤵
                                      PID:1792
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2B9E404A-B100-4D3D-AA15-CC7B233C6988}'" delete
                                    2⤵
                                      PID:1164
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2B9E404A-B100-4D3D-AA15-CC7B233C6988}'" delete
                                        3⤵
                                          PID:604
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{92DC6E8B-FBF2-453C-AF69-61FA7D811DCF}'" delete
                                        2⤵
                                          PID:3024
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{92DC6E8B-FBF2-453C-AF69-61FA7D811DCF}'" delete
                                            3⤵
                                              PID:448
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7C7FA08F-BC2C-483C-871A-29E57DDC73C2}'" delete
                                            2⤵
                                              PID:3020
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7C7FA08F-BC2C-483C-871A-29E57DDC73C2}'" delete
                                                3⤵
                                                  PID:1592
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B187535-CA9B-427C-A9FB-7E8CC535707B}'" delete
                                                2⤵
                                                  PID:2792
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B187535-CA9B-427C-A9FB-7E8CC535707B}'" delete
                                                    3⤵
                                                      PID:1984
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45B8D93A-03B9-4DE3-BFE4-D0BC33383D0D}'" delete
                                                    2⤵
                                                      PID:1552
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45B8D93A-03B9-4DE3-BFE4-D0BC33383D0D}'" delete
                                                        3⤵
                                                          PID:1596
                                                    • C:\Windows\system32\vssvc.exe
                                                      C:\Windows\system32\vssvc.exe
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2684

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files (x86)\R3ADM3.txt
                                                      Filesize

                                                      223B

                                                      MD5

                                                      b4f717b15c12f77abb29467fda9b8289

                                                      SHA1

                                                      bb52fcf3925c992e772eccc237f506cc725d7859

                                                      SHA256

                                                      469aade655b9400da980dbeb13429b36ec56ce46851dacc168892754b5b17ddb

                                                      SHA512

                                                      9a4a82424a8cacdeaab6f823187f38d64655075a7175a3abbb359449d8b527859f9a203d98f7f188e788aa78ede880ba89adb76a86bf79ce881e002cf6c94fbb

                                                      Download Submit

                                                    • memory/2972-0-0x0000000001E30000-0x0000000001E62000-memory.dmp

                                                      Filesize

                                                      200KB

                                                      Download

                                                    • memory/2972-9-0x00000000003A0000-0x00000000003CF000-memory.dmp

                                                      Filesize

                                                      188KB

                                                      Download

                                                    • memory/2972-4-0x0000000001E70000-0x0000000001EA1000-memory.dmp

                                                      Filesize

                                                      196KB

                                                      Download