Overview

overview

10

Static

static

10

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

7

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

1

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

1

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

9

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

5

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

Resubmissions

24-08-2023 11:16

230824-nda8msdf8z 10

05-08-2023 22:52

230805-2tn2bsfa82 10

24-07-2023 06:25

230724-g6s6laag35 10

22-07-2023 15:57

230722-tee6wabg5w 10

20-07-2023 23:19

230720-3bb5gsbf5v 10

20-07-2023 23:06

230720-23f23sba63 10

03-02-2021 11:43

210203-6bgge2nfan 10

22-11-2020 06:42

201122-6x1at779dj 10

Analysis

  • max time kernel
    307s
  • max time network
    301s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    03-02-2021 11:43

General

  • Target

    Endermanch@HappyAntivirus.exe

  • Size

    1.9MB

  • MD5

    cb02c0438f3f4ddabce36f8a26b0b961

  • SHA1

    48c4fcb17e93b74030415996c0ec5c57b830ea53

  • SHA256

    64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

  • SHA512

    373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Score
10/10

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Endermanch@HappyAntivirus.exe
    "C:\Users\Admin\AppData\Local\Temp\Endermanch@HappyAntivirus.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:860
  • C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Modifies extensions of user files
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
            PID:1332
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 613438188 && exit"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4024
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 613438188 && exit"
            4⤵
            • Creates scheduled task(s)
            PID:2068
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:01:00
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3612
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:01:00
            4⤵
            • Creates scheduled task(s)
            PID:2344
        • C:\Windows\81F2.tmp
          "C:\Windows\81F2.tmp" \\.\pipe\{B78FEBAB-F370-412B-93A2-E4045033D428}
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3588

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\81F2.tmp
      MD5

      347ac3b6b791054de3e5720a7144a977

      SHA1

      413eba3973a15c1a6429d9f170f3e8287f98c21c

      SHA256

      301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

      SHA512

      9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

    • C:\Windows\81F2.tmp
      MD5

      347ac3b6b791054de3e5720a7144a977

      SHA1

      413eba3973a15c1a6429d9f170f3e8287f98c21c

      SHA256

      301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

      SHA512

      9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

    • memory/860-9-0x0000000005A20000-0x0000000005A21000-memory.dmp
      Filesize

      4KB

    • memory/860-6-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
      Filesize

      4KB

    • memory/860-7-0x0000000005870000-0x0000000005871000-memory.dmp
      Filesize

      4KB

    • memory/860-8-0x00000000057A0000-0x00000000057A1000-memory.dmp
      Filesize

      4KB

    • memory/860-5-0x00000000056E0000-0x00000000056E1000-memory.dmp
      Filesize

      4KB

    • memory/860-10-0x0000000005910000-0x0000000005911000-memory.dmp
      Filesize

      4KB

    • memory/860-11-0x0000000005A23000-0x0000000005A25000-memory.dmp
      Filesize

      8KB

    • memory/860-2-0x0000000074070000-0x000000007475E000-memory.dmp
      Filesize

      6.9MB

    • memory/860-3-0x0000000000D10000-0x0000000000D11000-memory.dmp
      Filesize

      4KB

    • memory/1332-15-0x0000000000000000-mapping.dmp
    • memory/2068-21-0x0000000000000000-mapping.dmp
    • memory/2336-14-0x0000000000000000-mapping.dmp
    • memory/2344-22-0x0000000000000000-mapping.dmp
    • memory/3024-13-0x0000000003710000-0x0000000003778000-memory.dmp
      Filesize

      416KB

    • memory/3024-12-0x0000000000000000-mapping.dmp
    • memory/3588-18-0x0000000000000000-mapping.dmp
    • memory/3612-17-0x0000000000000000-mapping.dmp
    • memory/4024-16-0x0000000000000000-mapping.dmp