Overview

overview

10

Static

static

10

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

7

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

7

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

6

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

9

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

7

ฺฺฺK...ฺฺ

windows10_x64

ฺฺฺK...ฺฺ

windows10_x64

10

Resubmissions

03-07-2024 22:59

240703-2yn7wszhlp 10

03-07-2024 16:13

240703-tn93lsyglf 10

03-07-2024 16:11

240703-tm84xsyfma 10

10-05-2024 16:25

240510-tw1h5shh47 10

24-08-2023 11:16

230824-nda8msdf8z 10

Analysis

  • max time kernel
    939s
  • max time network
    948s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-11-2020 06:42

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    [email protected]

  • Size

    739KB

  • MD5

    382430dd7eae8945921b7feab37ed36b

  • SHA1

    c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

  • SHA256

    70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

  • SHA512

    26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

Score
10/10
badrabbitbootkitevasionpersistenceransomwaretrojanupx

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Deletes NTFS Change Journal 2 TTPs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Clears Windows event logs 1 TTPs
    evasionransomware
  • Blacklisted process makes network request 2 IoCs
  • Disables RegEdit via registry modification
    evasion
  • Executes dropped EXE 3 IoCs
  • Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs

    Enables rebooting of the machine without requiring login credentials.

    ransomwarebootkit
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Modifies service 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 14 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 2283 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 65 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\WINDOWS\302746537.exe
      "C:\WINDOWS\302746537.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:732
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A398.tmp\302746537.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s c:\windows\comctl32.ocx
          4⤵
          • Modifies registry class
          PID:3272
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32 /s c:\windows\mscomctl.ocx
          4⤵
          • Modifies registry class
          PID:1492
        • \??\c:\windows\antivirus-platinum.exe
          c:\windows\antivirus-platinum.exe
          4⤵
          • Executes dropped EXE
          • Windows security modification
          • Modifies service
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1524
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h c:\windows\antivirus-platinum.exe
          4⤵
          • Drops file in Windows directory
          • Views/modifies file attributes
          PID:416
  • C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Blacklisted process makes network request
      • Modifies extensions of user files
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:848
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
            PID:812
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 982044163 && exit"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:976
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 982044163 && exit"
            4⤵
            • Creates scheduled task(s)
            PID:3548
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
            4⤵
            • Creates scheduled task(s)
            PID:1400
        • C:\Windows\38B.tmp
          "C:\Windows\38B.tmp" \\.\pipe\{7238A243-7DA2-4BAB-9E06-33C03AC8A08B}
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3736
        • C:\Windows\SysWOW64\cmd.exe
          /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2656
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl Setup
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3868
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl System
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2952
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl Security
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2696
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl Application
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1120
          • C:\Windows\SysWOW64\fsutil.exe
            fsutil usn deletejournal /D C:
            4⤵
              PID:1408
          • C:\Windows\SysWOW64\cmd.exe
            /c schtasks /Delete /F /TN drogon
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2568
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Delete /F /TN drogon
              4⤵
                PID:3968
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x0 /state0:0xa3ad5855 /state1:0x41c64e6d
          1⤵
          • Modifies WinLogon to allow AutoLogon
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:204

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/848-18-0x0000000000D20000-0x0000000000D88000-memory.dmp

          Filesize

          416KB

          Download