Overview

overview

10

Static

static

10

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

7

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

7

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

6

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

9

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

7

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

10

Resubmissions

03-07-2024 22:59

240703-2yn7wszhlp 10

03-07-2024 16:13

240703-tn93lsyglf 10

03-07-2024 16:11

240703-tm84xsyfma 10

10-05-2024 16:25

240510-tw1h5shh47 10

24-08-2023 11:16

230824-nda8msdf8z 10

Analysis

  • max time kernel
    926s
  • max time network
    936s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-11-2020 06:42

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    [email protected]

  • Size

    1.1MB

  • MD5

    2eb3ce80b26345bd139f7378330b19c1

  • SHA1

    10122bd8dd749e20c132d108d176794f140242b0

  • SHA256

    8abed3ea04d52c42bdd6c9169c59212a7d8c649c12006b8278eda5aa91154cd2

  • SHA512

    e3223cd07d59cd97893304a3632b3a66fd91635848160c33011c103cca2badbfe9b78fe258666b634e455872f3a98889ede5a425d8fae91cae6983da1ea1190a

Score
10/10
badrabbitbootkitevasionpersistenceransomware

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Deletes NTFS Change Journal 2 TTPs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Clears Windows event logs 1 TTPs
    evasionransomware
  • Blacklisted process makes network request 11 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs

    Enables rebooting of the machine without requiring login credentials.

    ransomwarebootkit
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • JavaScript code in executable 28 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 131 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 66 IoCs
  • Suspicious use of FindShellTrayWindow 108 IoCs
  • Suspicious use of SendNotifyMessage 103 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 71 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe
      "C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.porntube.com
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:82945 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2540
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:82951 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1520
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:82954 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2100
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:82960 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2400
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.viagra.com
        3⤵
          PID:2020
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://www.porntube.com
          3⤵
            PID:3228
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://www.viagra.com
            3⤵
            • Modifies Internet Explorer settings
            PID:3504
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://www.porntube.com
            3⤵
              PID:1384
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4068
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
            2⤵
            • Blacklisted process makes network request
            • Modifies extensions of user files
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4088
            • C:\Windows\SysWOW64\cmd.exe
              /c schtasks /Delete /F /TN rhaegal
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3268
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Delete /F /TN rhaegal
                4⤵
                  PID:2372
              • C:\Windows\SysWOW64\cmd.exe
                /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1223011611 && exit"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:584
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1223011611 && exit"
                  4⤵
                  • Creates scheduled task(s)
                  PID:2808
              • C:\Windows\SysWOW64\cmd.exe
                /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:204
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
                  4⤵
                  • Creates scheduled task(s)
                  PID:3012
              • C:\Windows\F6AA.tmp
                "C:\Windows\F6AA.tmp" \\.\pipe\{3EE1A54B-22CB-441B-A17F-37B88E2802C4}
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:832
              • C:\Windows\SysWOW64\cmd.exe
                /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3444
                • C:\Windows\SysWOW64\wevtutil.exe
                  wevtutil cl Setup
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1880
                • C:\Windows\SysWOW64\wevtutil.exe
                  wevtutil cl System
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:720
                • C:\Windows\SysWOW64\wevtutil.exe
                  wevtutil cl Security
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:152
                • C:\Windows\SysWOW64\wevtutil.exe
                  wevtutil cl Application
                  4⤵
                    PID:1924
                  • C:\Windows\SysWOW64\fsutil.exe
                    fsutil usn deletejournal /D C:
                    4⤵
                      PID:1512
                  • C:\Windows\SysWOW64\cmd.exe
                    /c schtasks /Delete /F /TN drogon
                    3⤵
                      PID:3580
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /Delete /F /TN drogon
                        4⤵
                          PID:3832
                  • C:\Windows\system32\LogonUI.exe
                    "LogonUI.exe" /flags:0x0 /state0:0xa3ad7055 /state1:0x41c64e6d
                    1⤵
                    • Modifies WinLogon to allow AutoLogon
                    • Modifies data under HKEY_USERS
                    • Suspicious use of SetWindowsHookEx
                    PID:700

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/2100-187-0x000000000EAB0000-0x000000000EAC0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2100-183-0x000000000EBD0000-0x000000000EBE0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2100-186-0x000000000EBD0000-0x000000000EBE0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2100-189-0x000000000EBD0000-0x000000000EBE0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2100-188-0x000000000EAB0000-0x000000000EAC0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/3320-3-0x00007FFC989A0000-0x00007FFC98A1E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/3320-4-0x00007FFC823A0000-0x00007FFC82D40000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/4088-6-0x0000000003B20000-0x0000000003B88000-memory.dmp

                    Filesize

                    416KB

                    Download