{
  "family": "daws",
  "sample_count": 246,
  "category": "ransomware",
  "description": "TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware delivery mechanism engineered to breach endpoint perimeters and orchestrate the automated deployment of secondary extortion payloads. Operating through heavily packed executables dropped into temporary system directories (%Temp%), Daws establishes scheduled tasks and modifies registry Run keys to ensure persistence. Once a machine profile is established, Daws initiates encrypted HTTPS beacons to remote C2 infrastructure, pulling down secondary ransomware binaries that systematically traverse local and mapped network drives, encrypt target document and database extensions, delete Volume Shadow Copies via vssadmin, and display ransom notes demanding cryptocurrency payments.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Daws",
    "TrojanDownloader:Win32/Daws",
    "Trojan.Daws",
    "Win32/Daws",
    "Daws Downloader",
    "Ransom.Daws",
    "Trojan:Win32/Daws"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Daws malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Daws is a persistent Trojan downloader and ransomware staging tool that establishes system persistence to deploy file-encrypting extortion payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Daws deploy ransomware onto compromised endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Daws communicates over encrypted HTTPS channels to download secondary ransomware binaries, which execute and encrypt files across local and network drives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Daws maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Daws drops randomized executables into the %Temp% directory and creates hidden Windows Scheduled Tasks and registry Run keys."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were exploited in Daws distribution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Daws campaigns leveraged Microsoft Office vulnerabilities including CVE-2017-0199 and CVE-2017-11882 in weaponized email attachments."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators mitigate a Daws ransomware infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate infected hosts immediately, terminate suspicious scheduled tasks, block outbound C2 network connections, and restore encrypted data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1105",
    "T1053.005",
    "T1027",
    "T1071.001",
    "T1547.001",
    "T1490"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "impact"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "command-and-control"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task",
      "tactic": "persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "impact"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2014,
  "lineage": {
    "derived_from": [],
    "variants": [
      "daws.a downloader",
      "daws ransomware stage",
      "daws scheduled task variant"
    ]
  },
  "attribution": [
    {
      "actor": "Cybercrime Ransomware Affiliates",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2017-0199",
    "CVE-2017-11882"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS",
      "HTTP"
    ],
    "ports": [
      443,
      80,
      8080
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "2e3f4a5b6c708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f81122",
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a22"
    ],
    "delivery": [
      "malspam_weaponized_archives",
      "exploit_kit_landing_pages"
    ],
    "persistence": [
      "Windows Task Scheduler Job Creation",
      "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Security Intelligence: TrojanDownloader:Win32/Daws Technical Guidance",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Daws"
    },
    {
      "name": "Trend Micro Threat Encyclopedia: Trojan.Daws Analysis",
      "url": "https://www.trendmicro.com/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2017-11882",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11882"
    }
  ],
  "containment_steps": [
    "Immediately disconnect infected machines from internal networks to stop active ransomware spreading across shared drives.",
    "Audit Windows Task Scheduler and delete unauthorized tasks executing binaries from %Temp% or AppData folders.",
    "Verify the integrity of immutable offline backups before attempting system restoration.",
    "Deploy security updates patching Microsoft Office Equation Editor vulnerability CVE-2017-11882."
  ],
  "what_to_avoid": [
    "Do not pay ransom demands, as payment finances criminal operations and offers no guarantee of decryption.",
    "Avoid allowing endpoints to execute scripts or unsigned binaries directly out of %Temp% directories.",
    "Never neglect monitoring unauthorized vssadmin executions targeting Volume Shadow Copies."
  ],
  "target_industries": [
    "healthcare",
    "manufacturing",
    "small_business",
    "education",
    "critical_infrastructure"
  ],
  "motivation": "Financial Extortion, Ransomware Staging & System Disruption",
  "threat_actors": [
    "Cybercrime Ransomware Affiliates"
  ],
  "target_geographies": [
    "US",
    "DE",
    "GB",
    "FR",
    "IT",
    "CA",
    "AU",
    "ES"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "command-and-control",
    "impact"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}