c49eb3f83f94347d223338a13a2a57387ac689dc16d64f3d41a251b3a3325e5d

Resubmissions

16/06/2020, 04:11

200616-ytvjca5a1a 10

16/06/2020, 04:05

200616-ax6m7e1tkn 10

Analysis

max time kernel
141s
max time network
42s
platform
windows7_x64
resource
win7v200430
submitted
16/06/2020, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Badboymnb.exe
Size

23KB
MD5

0bf3158979d38b3d3c99ccfa5b1b4a83
SHA1

f8eb3e0ab7f09eb93125afa11d5c793f55e1c607
SHA256

c49eb3f83f94347d223338a13a2a57387ac689dc16d64f3d41a251b3a3325e5d
SHA512

938b82fde3e7bddb96948d9548ebd325dd63fb01292a8a8fcb22e102b51bee66143be21d24c18d9e9a6b6c2518e82992e056fccf4fa7492938ffe8848bcc096a

Score

10^/10

ransomware persistence spyware

Malware Config

Extracted

Path

C:\ReadME-BadboyEncryption.txt

Ransom Note

All your data has been locked us. You want to return? Contact to Email: [email protected] Your Personal Key : Bb9JcGVCqdLiEw1z1W7f3OYN+CTC3XlmA/sVd3slXMFMqx7WKTlwMcnz4WlLtr2DijaUDvFmrF3wsmo4j/yJym/hOQiw5gcxGCC8H9FQLB3cp32TSXZF4pn4h7+vw4gY+ebDS1SV00P5pboPoWTbwl107WT54MJX/0PzB9TUdsW2tzILfaqd2vUW+5OxdHwZvPB2ij8st3l4WIKkuwtgwFMQaruAxXT55HykE1hQFrlh1j/UXaK7h09g5Ufc12Alv+qRcoZTwzkVCMe8Nzi8YNevDC6ffoH3NXgNJ5dLPCqplt0Y5aqwtPN0A6j1XBBcgpOUa3dEN76s9Ny1HO1VPg==

Emails

[email protected]

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1600	1092	Badboymnb.exe	29
PID 1092 wrote to memory of 1600	1092	Badboymnb.exe	29
PID 1092 wrote to memory of 1600	1092	Badboymnb.exe	29
PID 1092 wrote to memory of 1600	1092	Badboymnb.exe	29
PID 1600 wrote to memory of 548	1600	cmd.exe	31
PID 1600 wrote to memory of 548	1600	cmd.exe	31
PID 1600 wrote to memory of 548	1600	cmd.exe	31
PID 1600 wrote to memory of 548	1600	cmd.exe	31

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1816	vssvc.exe
Token: SeRestorePrivilege	1816	vssvc.exe
Token: SeAuditPrivilege	1816	vssvc.exe

Drops desktop.ini file(s) 83 IoCs

description	ioc	Process
File created	C:\Users\Public\Libraries\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Music\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\557LH6Z9\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OT4YD26O\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Music\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Pictures\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Downloads\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XGJ27KX4\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Desktop\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Downloads\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Badboymnb.exe
File created	C:\Users\Public\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Q8AAMSB\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Favorites\Links for United States\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Music\Sample Music\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Pictures\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Links\desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Desktop\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZDAW0I3Y\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Recorded TV\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\LUBVL9MG\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Contacts\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Videos\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\IQD6DIKV\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1IGGBW8Z\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Videos\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Documents\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Favorites\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Searches\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Documents\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Videos\Sample Videos\desktop.ini	Badboymnb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	NOTEPAD.EXE

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
548	vssadmin.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Badboymnb.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

C:\Users\Admin\AppData\Local\Temp\Badboymnb.exe
"C:\Users\Admin\AppData\Local\Temp\Badboymnb.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Drops desktop.ini file(s)
- Drops startup file
PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:548

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1816

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\ReadME-BadboyEncryption.txt
1⤵
- Suspicious use of FindShellTrayWindow
PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact