badrabbit | f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Target

Endermanch@AntivirusPlatinum.exe
Size

739KB
MD5

382430dd7eae8945921b7feab37ed36b
SHA1

c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA256

70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA512

26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

Score

10^/10

badrabbit bootkit evasion persistence ransomware trojan upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Deletes NTFS Change Journal 2 TTPs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
ransomware

Inhibit System Recovery
T1490

Data Destruction
T1485
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Blacklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

217 848 rundll32.exe
228 848 rundll32.exe
Disables RegEdit via registry modification
evasion
Executes dropped EXE 3 IoCs

Processes:

302746537.exeantivirus-platinum.exe38B.tmp

pid process

732 302746537.exe
1524 antivirus-platinum.exe
3736 38B.tmp
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
ransomware bootkit

Winlogon Helper DLL
T1004

Modify Registry
T1112

Processes:

LogonUI.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe

flow	pid	process
217	848	rundll32.exe
228	848	rundll32.exe

pid	process
732	302746537.exe
1524	antivirus-platinum.exe
3736	38B.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\CloseDeny.tiff	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertToPush.tiff	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\WINDOWS\302746537.exe	upx
C:\Windows\302746537.exe	upx
C:\Windows\antivirus-platinum.exe	upx
\??\c:\windows\antivirus-platinum.exe	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Modifies service 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

antivirus-platinum.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\sr = "4" antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\sr = "4"	antivirus-platinum.exe

Drops file in Windows directory 14 IoCs

Processes:

attrib.exerundll32.exeEndermanch@AntivirusPlatinum.exe

description	ioc	process
File opened for modification	C:\windows\antivirus-platinum.exe	attrib.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_259301656	Endermanch@AntivirusPlatinum.exe
File opened for modification	C:\Windows\MSCOMCTL.OCX	Endermanch@AntivirusPlatinum.exe
File opened for modification	C:\Windows\302746537.exe	Endermanch@AntivirusPlatinum.exe
File created	C:\Windows\antivirus-platinum.exe	Endermanch@AntivirusPlatinum.exe
File opened for modification	C:\Windows\COMCTL32.OCX	Endermanch@AntivirusPlatinum.exe
File opened for modification	C:\Windows\38B.tmp	rundll32.exe
File opened for modification	C:\Windows\antivirus-platinum.exe	Endermanch@AntivirusPlatinum.exe
File created	C:\Windows\COMCTL32.OCX	Endermanch@AntivirusPlatinum.exe
File created	C:\Windows\MSCOMCTL.OCX	Endermanch@AntivirusPlatinum.exe
File created	C:\Windows\302746537.exe	Endermanch@AntivirusPlatinum.exe
File created	C:\Windows\dispci.exe	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3548 schtasks.exe
1400 schtasks.exe

pid	process
3548	schtasks.exe
1400	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	antivirus-platinum.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 2283 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD2-E01E-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC0AB1C0-6CAB-11CF-8998-00AA00688B10}\ = "IControls"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\ = "IListSubItems"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Version\ = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\ = "Microsoft ProgressBar Control 6.0 (SP4)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E80-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E84-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip\CurVer\ = "MSComctlLib.TabStrip.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TreeCtrl\CurVer\ = "COMCTL.TreeCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\ = "StatusBar General Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\CLSID\ = "{F08DF954-8592-11D1-B16A-00C0F0283628}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8D0-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA660-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl\CLSID\ = "{0713E8D2-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8626-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877890-E026-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D90-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\ = "Progress Bar General Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

rundll32.exe38B.tmp

pid	process
848	rundll32.exe
848	rundll32.exe
848	rundll32.exe
848	rundll32.exe
3736	38B.tmp
3736	38B.tmp
3736	38B.tmp
3736	38B.tmp
3736	38B.tmp
3736	38B.tmp
848	rundll32.exe
848	rundll32.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

rundll32.exe38B.tmpwevtutil.exewevtutil.exewevtutil.exewevtutil.exe

description	pid	process
Token: SeShutdownPrivilege	848	rundll32.exe
Token: SeDebugPrivilege	848	rundll32.exe
Token: SeTcbPrivilege	848	rundll32.exe
Token: SeDebugPrivilege	3736	38B.tmp
Token: SeSecurityPrivilege	3868	wevtutil.exe
Token: SeBackupPrivilege	3868	wevtutil.exe
Token: SeSecurityPrivilege	2952	wevtutil.exe
Token: SeBackupPrivilege	2952	wevtutil.exe
Token: SeSecurityPrivilege	2696	wevtutil.exe
Token: SeBackupPrivilege	2696	wevtutil.exe
Token: SeSecurityPrivilege	1120	wevtutil.exe
Token: SeBackupPrivilege	1120	wevtutil.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

antivirus-platinum.exeLogonUI.exe

pid process

1524 antivirus-platinum.exe
204 LogonUI.exe

pid	process
1524	antivirus-platinum.exe
204	LogonUI.exe

Suspicious use of WriteProcessMemory 65 IoCs

Processes:

Endermanch@AntivirusPlatinum.exe302746537.execmd.exerundll32.exerundll32.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 8 wrote to memory of 732	8	Endermanch@AntivirusPlatinum.exe	302746537.exe
PID 8 wrote to memory of 732	8	Endermanch@AntivirusPlatinum.exe	302746537.exe
PID 8 wrote to memory of 732	8	Endermanch@AntivirusPlatinum.exe	302746537.exe
PID 732 wrote to memory of 868	732	302746537.exe	cmd.exe
PID 732 wrote to memory of 868	732	302746537.exe	cmd.exe
PID 732 wrote to memory of 868	732	302746537.exe	cmd.exe
PID 868 wrote to memory of 3272	868	cmd.exe	regsvr32.exe
PID 868 wrote to memory of 3272	868	cmd.exe	regsvr32.exe
PID 868 wrote to memory of 3272	868	cmd.exe	regsvr32.exe
PID 868 wrote to memory of 1492	868	cmd.exe	regsvr32.exe
PID 868 wrote to memory of 1492	868	cmd.exe	regsvr32.exe
PID 868 wrote to memory of 1492	868	cmd.exe	regsvr32.exe
PID 868 wrote to memory of 1524	868	cmd.exe	antivirus-platinum.exe
PID 868 wrote to memory of 1524	868	cmd.exe	antivirus-platinum.exe
PID 868 wrote to memory of 1524	868	cmd.exe	antivirus-platinum.exe
PID 868 wrote to memory of 416	868	cmd.exe	attrib.exe
PID 868 wrote to memory of 416	868	cmd.exe	attrib.exe
PID 868 wrote to memory of 416	868	cmd.exe	attrib.exe
PID 3576 wrote to memory of 848	3576	rundll32.exe	rundll32.exe
PID 3576 wrote to memory of 848	3576	rundll32.exe	rundll32.exe
PID 3576 wrote to memory of 848	3576	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 2052	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 2052	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 2052	848	rundll32.exe	cmd.exe
PID 2052 wrote to memory of 812	2052	cmd.exe	schtasks.exe
PID 2052 wrote to memory of 812	2052	cmd.exe	schtasks.exe
PID 2052 wrote to memory of 812	2052	cmd.exe	schtasks.exe
PID 848 wrote to memory of 976	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 976	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 976	848	rundll32.exe	cmd.exe
PID 976 wrote to memory of 3548	976	cmd.exe	schtasks.exe
PID 976 wrote to memory of 3548	976	cmd.exe	schtasks.exe
PID 976 wrote to memory of 3548	976	cmd.exe	schtasks.exe
PID 848 wrote to memory of 3680	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 3680	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 3680	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 3736	848	rundll32.exe	38B.tmp
PID 848 wrote to memory of 3736	848	rundll32.exe	38B.tmp
PID 3680 wrote to memory of 1400	3680	cmd.exe	schtasks.exe
PID 3680 wrote to memory of 1400	3680	cmd.exe	schtasks.exe
PID 3680 wrote to memory of 1400	3680	cmd.exe	schtasks.exe
PID 848 wrote to memory of 2656	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 2656	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 2656	848	rundll32.exe	cmd.exe
PID 2656 wrote to memory of 3868	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 3868	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 3868	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 2952	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 2952	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 2952	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 2696	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 2696	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 2696	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 1120	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 1120	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 1120	2656	cmd.exe	wevtutil.exe
PID 2656 wrote to memory of 1408	2656	cmd.exe	fsutil.exe
PID 2656 wrote to memory of 1408	2656	cmd.exe	fsutil.exe
PID 2656 wrote to memory of 1408	2656	cmd.exe	fsutil.exe
PID 848 wrote to memory of 2568	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 2568	848	rundll32.exe	cmd.exe
PID 848 wrote to memory of 2568	848	rundll32.exe	cmd.exe
PID 2568 wrote to memory of 3968	2568	cmd.exe	schtasks.exe
PID 2568 wrote to memory of 3968	2568	cmd.exe	schtasks.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

antivirus-platinum.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	antivirus-platinum.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

416 attrib.exe

pid	process
416	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Endermanch@AntivirusPlatinum.exe
"C:\Users\Admin\AppData\Local\Temp\Endermanch@AntivirusPlatinum.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:8

C:\WINDOWS\302746537.exe
"C:\WINDOWS\302746537.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A398.tmp\302746537.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\comctl32.ocx
4⤵
- Modifies registry class
PID:3272

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\mscomctl.ocx
4⤵
- Modifies registry class
PID:1492

\??\c:\windows\antivirus-platinum.exe
c:\windows\antivirus-platinum.exe
4⤵
- Executes dropped EXE
- Windows security modification
- Modifies service
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1524

C:\Windows\SysWOW64\attrib.exe
attrib +h c:\windows\antivirus-platinum.exe
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:416

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
1⤵
- Suspicious use of WriteProcessMemory
PID:3576

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Delete /F /TN rhaegal
3⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /F /TN rhaegal
4⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 982044163 && exit"
3⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 982044163 && exit"
4⤵
- Creates scheduled task(s)
PID:3548

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
3⤵
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
4⤵
- Creates scheduled task(s)
PID:1400

C:\Windows\38B.tmp
"C:\Windows\38B.tmp" \\.\pipe\{7238A243-7DA2-4BAB-9E06-33C03AC8A08B}
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\SysWOW64\cmd.exe
/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
3⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\wevtutil.exe
wevtutil cl Setup
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\SysWOW64\wevtutil.exe
wevtutil cl System
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\SysWOW64\wevtutil.exe
wevtutil cl Security
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\wevtutil.exe
wevtutil cl Application
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\SysWOW64\fsutil.exe
fsutil usn deletejournal /D C:
4⤵
PID:1408

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Delete /F /TN drogon
3⤵
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /F /TN drogon
4⤵
PID:3968

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad5855 /state1:0x41c64e6d
1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Indicator Removal on Host

T1070

Hidden Files and Directories

T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Data Destruction

T1485

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A398.tmp\302746537.bat
MD5
7d8beb22dfcfacbbc2609f88a41c1458

SHA1
52ec2b10489736b963d39a9f84b66bafbf15685f

SHA256
4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2

SHA512
a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

Download Submit
C:\WINDOWS\302746537.exe
MD5
8703ff2e53c6fd3bc91294ef9204baca

SHA1
3dbb8f7f5dfe6b235486ab867a2844b1c2143733

SHA256
3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

SHA512
d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

Download Submit
C:\Windows\302746537.exe
MD5
8703ff2e53c6fd3bc91294ef9204baca

SHA1
3dbb8f7f5dfe6b235486ab867a2844b1c2143733

SHA256
3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

SHA512
d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

Download Submit
C:\Windows\38B.tmp
MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\38B.tmp
MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\antivirus-platinum.exe
MD5
cd1800322ccfc425014a8394b01a4b3d

SHA1
171073975effde1c712dfd86309457fd457aed33

SHA256
8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0

SHA512
92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

Download Submit
\??\c:\windows\antivirus-platinum.exe
MD5
cd1800322ccfc425014a8394b01a4b3d

SHA1
171073975effde1c712dfd86309457fd457aed33

SHA256
8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0

SHA512
92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

Download Submit
\??\c:\windows\comctl32.ocx
MD5
821511549e2aaf29889c7b812674d59b

SHA1
3b2fd80f634a3d62277e0508bedca9aae0c5a0d6

SHA256
f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4

SHA512
8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

Download Submit
\??\c:\windows\mscomctl.ocx
MD5
714cf24fc19a20ae0dc701b48ded2cf6

SHA1
d904d2fa7639c38ffb6e69f1ef779ca1001b8c18

SHA256
09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712

SHA512
d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

Download Submit
memory/416-14-0x0000000000000000-mapping.dmp

Download
memory/732-1-0x0000000000000000-mapping.dmp

Download
memory/812-20-0x0000000000000000-mapping.dmp

Download
memory/848-17-0x0000000000000000-mapping.dmp

Download
memory/848-18-0x0000000000D20000-0x0000000000D88000-memory.dmp

Filesize
416KB

Download
memory/868-4-0x0000000000000000-mapping.dmp

Download
memory/976-21-0x0000000000000000-mapping.dmp

Download
memory/1120-32-0x0000000000000000-mapping.dmp

Download
memory/1400-27-0x0000000000000000-mapping.dmp

Download
memory/1408-33-0x0000000000000000-mapping.dmp

Download
memory/1492-8-0x0000000000000000-mapping.dmp

Download
memory/1524-11-0x0000000000000000-mapping.dmp

Download
memory/1524-10-0x0000000000000000-mapping.dmp

Download
memory/2052-19-0x0000000000000000-mapping.dmp

Download
memory/2568-34-0x0000000000000000-mapping.dmp

Download
memory/2656-28-0x0000000000000000-mapping.dmp

Download
memory/2696-31-0x0000000000000000-mapping.dmp

Download
memory/2952-30-0x0000000000000000-mapping.dmp

Download
memory/3272-6-0x0000000000000000-mapping.dmp

Download
memory/3548-22-0x0000000000000000-mapping.dmp

Download
memory/3680-23-0x0000000000000000-mapping.dmp

Download
memory/3736-24-0x0000000000000000-mapping.dmp

Download
memory/3868-29-0x0000000000000000-mapping.dmp

Download
memory/3968-35-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads