Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
6ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
03-07-2024 22:59
240703-2yn7wszhlp 1003-07-2024 16:13
240703-tn93lsyglf 1003-07-2024 16:11
240703-tm84xsyfma 1010-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 10Analysis
-
max time kernel
927s -
max time network
795s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-11-2020 06:42
Static task
static1
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
-
Size
618KB
-
MD5
a50fc0da1d2b3c4aa8a6adaccf69a5de
-
SHA1
e001f4043ab4be644ea10e0d65303d6e57b31ffe
-
SHA256
cf6eb8377789e316629c0396a2dbb53c69b5fd67bbd0e7163b8d305aaa756e90
-
SHA512
4bbc7676391ed4085f628d1f4e1f0af16f5cd6fd9efb8c61176bccdb6ee03b06896c6ddfba9fcf363b133ade3a8a1b8cd17ef92d8eb9adeec247f9bd41dbec2b
Score
10/10
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Deletes NTFS Change Journal 2 TTPs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" [email protected] -
Clears Windows event logs 1 TTPs
-
Blacklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid Process 219 4244 rundll32.exe 232 4244 rundll32.exe 244 4244 rundll32.exe 255 4244 rundll32.exe 447 4244 rundll32.exe 463 4244 rundll32.exe 474 4244 rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
DB04.tmppid Process 968 DB04.tmp -
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
Processes:
LogonUI.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum [email protected] Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 [email protected] -
Drops file in Windows directory 4 IoCs
Processes:
rundll32.exedescription ioc Process File opened for modification C:\Windows\DB04.tmp rundll32.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid Process 648 schtasks.exe 1376 schtasks.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 14742 IoCs
Processes:
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
description pid Process Token: SeShutdownPrivilege 4708 [email protected] Token: SeShutdownPrivilege 4244 rundll32.exe Token: SeDebugPrivilege 4244 rundll32.exe Token: SeTcbPrivilege 4244 rundll32.exe Token: SeDebugPrivilege 968 DB04.tmp Token: SeSecurityPrivilege 4532 wevtutil.exe Token: SeBackupPrivilege 4532 wevtutil.exe Token: SeSecurityPrivilege 3928 wevtutil.exe Token: SeBackupPrivilege 3928 wevtutil.exe Token: SeSecurityPrivilege 3788 wevtutil.exe Token: SeBackupPrivilege 3788 wevtutil.exe Token: SeSecurityPrivilege 2688 wevtutil.exe Token: SeBackupPrivilege 2688 wevtutil.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
[email protected]LogonUI.exepid Process 4708 [email protected] 4708 [email protected] 4372 LogonUI.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
rundll32.exerundll32.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 4252 wrote to memory of 4244 4252 rundll32.exe 79 PID 4252 wrote to memory of 4244 4252 rundll32.exe 79 PID 4252 wrote to memory of 4244 4252 rundll32.exe 79 PID 4244 wrote to memory of 1864 4244 rundll32.exe 80 PID 4244 wrote to memory of 1864 4244 rundll32.exe 80 PID 4244 wrote to memory of 1864 4244 rundll32.exe 80 PID 1864 wrote to memory of 3280 1864 cmd.exe 82 PID 1864 wrote to memory of 3280 1864 cmd.exe 82 PID 1864 wrote to memory of 3280 1864 cmd.exe 82 PID 4244 wrote to memory of 536 4244 rundll32.exe 83 PID 4244 wrote to memory of 536 4244 rundll32.exe 83 PID 4244 wrote to memory of 536 4244 rundll32.exe 83 PID 536 wrote to memory of 648 536 cmd.exe 85 PID 536 wrote to memory of 648 536 cmd.exe 85 PID 536 wrote to memory of 648 536 cmd.exe 85 PID 4244 wrote to memory of 808 4244 rundll32.exe 86 PID 4244 wrote to memory of 808 4244 rundll32.exe 86 PID 4244 wrote to memory of 808 4244 rundll32.exe 86 PID 4244 wrote to memory of 968 4244 rundll32.exe 87 PID 4244 wrote to memory of 968 4244 rundll32.exe 87 PID 808 wrote to memory of 1376 808 cmd.exe 90 PID 808 wrote to memory of 1376 808 cmd.exe 90 PID 808 wrote to memory of 1376 808 cmd.exe 90 PID 4244 wrote to memory of 2944 4244 rundll32.exe 92 PID 4244 wrote to memory of 2944 4244 rundll32.exe 92 PID 4244 wrote to memory of 2944 4244 rundll32.exe 92 PID 2944 wrote to memory of 4532 2944 cmd.exe 94 PID 2944 wrote to memory of 4532 2944 cmd.exe 94 PID 2944 wrote to memory of 4532 2944 cmd.exe 94 PID 2944 wrote to memory of 3928 2944 cmd.exe 95 PID 2944 wrote to memory of 3928 2944 cmd.exe 95 PID 2944 wrote to memory of 3928 2944 cmd.exe 95 PID 2944 wrote to memory of 3788 2944 cmd.exe 96 PID 2944 wrote to memory of 3788 2944 cmd.exe 96 PID 2944 wrote to memory of 3788 2944 cmd.exe 96 PID 2944 wrote to memory of 2688 2944 cmd.exe 97 PID 2944 wrote to memory of 2688 2944 cmd.exe 97 PID 2944 wrote to memory of 2688 2944 cmd.exe 97 PID 2944 wrote to memory of 2696 2944 cmd.exe 98 PID 2944 wrote to memory of 2696 2944 cmd.exe 98 PID 2944 wrote to memory of 2696 2944 cmd.exe 98 PID 4244 wrote to memory of 4648 4244 rundll32.exe 99 PID 4244 wrote to memory of 4648 4244 rundll32.exe 99 PID 4244 wrote to memory of 4648 4244 rundll32.exe 99 PID 4648 wrote to memory of 2884 4648 cmd.exe 102 PID 4648 wrote to memory of 2884 4648 cmd.exe 102 PID 4648 wrote to memory of 2884 4648 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4708
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 151⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Blacklisted process makes network request
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:3280
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3587941686 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3587941686 && exit"4⤵
- Creates scheduled task(s)
PID:648
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:003⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:004⤵
- Creates scheduled task(s)
PID:1376
-
-
-
C:\Windows\DB04.tmp"C:\Windows\DB04.tmp" \\.\pipe\{DD5C21E4-8A05-4C54-ADE7-6DBAF41D3B8F}3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
C:\Windows\SysWOW64\cmd.exe/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:3⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Setup4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl System4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Security4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Application4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\SysWOW64\fsutil.exefsutil usn deletejournal /D C:4⤵PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN drogon3⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN drogon4⤵PID:2884
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad2855 /state1:0x41c64e6d1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
MD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787