Overview

overview

10

Static

static

3

2db20e2fcd...18.exe

windows7-x64

10

2db20e2fcd...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    08-07-2024 20:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2db20e2fcd86d00388915088b18f99f2_JaffaCakes118.exe

  • Size

    92KB

  • MD5

    2db20e2fcd86d00388915088b18f99f2

  • SHA1

    3a321bf3980d08fe5754548f5aba7f1bdc967f10

  • SHA256

    40a837f93edb2531fe35733d725efb490c7b5199d031a6e087b5041aed6eea05

  • SHA512

    b9c179e2b5b82fa59018194e8ee8bb927dfd545c72772de6c98621a071650efa345e9bee0282caac95ccccce1371e440295f61a981d447d5ef699fd81e3d1450

  • SSDEEP

    1536:mBwl+KXpsqN5vlwWYyhY9S4AtUhjKkeODKTx8UdnwpZV3LZX3cccXxi9d0W:Qw+asqN5aW/hLMtKkejF8UWbVbV3cJB

Score
10/10
dharmadefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (309) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2db20e2fcd86d00388915088b18f99f2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2db20e2fcd86d00388915088b18f99f2_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2264
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2912
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:464
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:2424
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:232
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:3304
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:1044
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1560

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Indicator Removal

      2
      T1070

      File Deletion

      2
      T1070.004

      Modify Registry

      2
      T1112

      Direct Volume Access

      1
      T1006

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      2
      T1490

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-C6E14B19.[[email protected]].ROGER
        Filesize

        23.5MB

        MD5

        a8e40383896e0ebe5d279126462e4695

        SHA1

        d697063a39750d48f487b09c98108e2827616259

        SHA256

        f6ab577edf0617ff136a70edd4a400940d3e45f5da063339cec98afeee71548b

        SHA512

        e16a36b2968f573fb2ae5b5ffe4c68de570b0aa8d1e0176fd05e08289fa44033e5344f9e8347fc6b4baa2563c9b3113b4cac1857482c2fb615763ccc9fea0381

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
        Filesize

        7KB

        MD5

        3c61fa8562933d964a2f0ce296b5fc0e

        SHA1

        2f75341e81f9b42bf8abcaba4e7c4f3f45516aba

        SHA256

        c35a07f28dc1bbd8291ba6ab5e869a4f10d7a0c50b0ed35522e7c612706c6607

        SHA512

        86312641cd31e784e40caa18e1fb752a5b8f4e408cf11dacf30b1493bdd1689b4c51a05749b259bf429b7f423fef38c0f12b04e80c197062ecd055d4e35cae07

        Download Submit