Overview
overview
10Static
static
10ฺฺฺ�...ฺฺ
windows10_x64
ฺฺฺ�...ฺฺ
windows10_x64
ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
7ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
1ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
1ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
9ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
5ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
10Resubmissions
03-07-2024 22:59
240703-2yn7wszhlp 1003-07-2024 16:13
240703-tn93lsyglf 1003-07-2024 16:11
240703-tm84xsyfma 1010-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 10Analysis
-
max time kernel
305s -
max time network
317s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-02-2021 11:43
Static task
static1
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
General
-
Target
-
Size
2.0MB
-
MD5
c7e9746b1b039b8bd1106bca3038c38f
-
SHA1
cb93ac887876bafe39c5f9aa64970d5e747fb191
-
SHA256
b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
-
SHA512
cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724
Score
10/10
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Executes dropped EXE 1 IoCs
pid Process 4472 F2F7.tmp -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DisableOut.tiff rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan" [email protected] -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\AnVi\splash.mp3 [email protected] File created C:\Program Files (x86)\AnVi\virus.mp3 [email protected] -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\F2F7.tmp rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4644 schtasks.exe 1696 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" [email protected] -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2532 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 4316 mofcomp.exe Token: SeShutdownPrivilege 4052 rundll32.exe Token: SeDebugPrivilege 4052 rundll32.exe Token: SeTcbPrivilege 4052 rundll32.exe Token: SeDebugPrivilege 4472 F2F7.tmp -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4704 [email protected] 4704 [email protected] 4704 [email protected] -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4704 [email protected] 4704 [email protected] 4704 [email protected] -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4704 [email protected] 4704 [email protected] 4704 [email protected] 4704 [email protected] 4704 [email protected] 4704 [email protected] 4704 [email protected] 4704 [email protected] 4704 [email protected] 4704 [email protected] -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4704 wrote to memory of 3756 4704 [email protected] 75 PID 4704 wrote to memory of 3756 4704 [email protected] 75 PID 4704 wrote to memory of 3756 4704 [email protected] 75 PID 4704 wrote to memory of 3808 4704 [email protected] 76 PID 4704 wrote to memory of 3808 4704 [email protected] 76 PID 4704 wrote to memory of 3808 4704 [email protected] 76 PID 4704 wrote to memory of 3980 4704 [email protected] 77 PID 4704 wrote to memory of 3980 4704 [email protected] 77 PID 4704 wrote to memory of 3980 4704 [email protected] 77 PID 4704 wrote to memory of 4024 4704 [email protected] 78 PID 4704 wrote to memory of 4024 4704 [email protected] 78 PID 4704 wrote to memory of 4024 4704 [email protected] 78 PID 4704 wrote to memory of 4316 4704 [email protected] 79 PID 4704 wrote to memory of 4316 4704 [email protected] 79 PID 4704 wrote to memory of 4316 4704 [email protected] 79 PID 3808 wrote to memory of 1316 3808 net.exe 87 PID 3808 wrote to memory of 1316 3808 net.exe 87 PID 3808 wrote to memory of 1316 3808 net.exe 87 PID 3756 wrote to memory of 1324 3756 net.exe 86 PID 3756 wrote to memory of 1324 3756 net.exe 86 PID 3756 wrote to memory of 1324 3756 net.exe 86 PID 3980 wrote to memory of 1264 3980 net.exe 88 PID 3980 wrote to memory of 1264 3980 net.exe 88 PID 3980 wrote to memory of 1264 3980 net.exe 88 PID 4024 wrote to memory of 1468 4024 net.exe 85 PID 4024 wrote to memory of 1468 4024 net.exe 85 PID 4024 wrote to memory of 1468 4024 net.exe 85 PID 3996 wrote to memory of 4052 3996 rundll32.exe 93 PID 3996 wrote to memory of 4052 3996 rundll32.exe 93 PID 3996 wrote to memory of 4052 3996 rundll32.exe 93 PID 4052 wrote to memory of 4308 4052 rundll32.exe 94 PID 4052 wrote to memory of 4308 4052 rundll32.exe 94 PID 4052 wrote to memory of 4308 4052 rundll32.exe 94 PID 4308 wrote to memory of 8 4308 cmd.exe 96 PID 4308 wrote to memory of 8 4308 cmd.exe 96 PID 4308 wrote to memory of 8 4308 cmd.exe 96 PID 4052 wrote to memory of 3956 4052 rundll32.exe 97 PID 4052 wrote to memory of 3956 4052 rundll32.exe 97 PID 4052 wrote to memory of 3956 4052 rundll32.exe 97 PID 4052 wrote to memory of 4456 4052 rundll32.exe 99 PID 4052 wrote to memory of 4456 4052 rundll32.exe 99 PID 4052 wrote to memory of 4456 4052 rundll32.exe 99 PID 4052 wrote to memory of 4472 4052 rundll32.exe 101 PID 4052 wrote to memory of 4472 4052 rundll32.exe 101 PID 3956 wrote to memory of 1696 3956 cmd.exe 100 PID 3956 wrote to memory of 1696 3956 cmd.exe 100 PID 3956 wrote to memory of 1696 3956 cmd.exe 100 PID 4456 wrote to memory of 4644 4456 cmd.exe 104 PID 4456 wrote to memory of 4644 4456 cmd.exe 104 PID 4456 wrote to memory of 4644 4456 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\net.exenet stop wscsvc2⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc3⤵PID:1324
-
-
-
C:\Windows\SysWOW64\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:1316
-
-
-
C:\Windows\SysWOW64\net.exenet start winmgmt2⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start winmgmt3⤵PID:1264
-
-
-
C:\Windows\SysWOW64\net.exenet start wscsvc2⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc3⤵PID:1468
-
-
-
C:\Windows\SysWOW64\Wbem\mofcomp.exemofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 151⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Modifies extensions of user files
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:8
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2401532936 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2401532936 && exit"4⤵
- Creates scheduled task(s)
PID:1696
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:09:003⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:09:004⤵
- Creates scheduled task(s)
PID:4644
-
-
-
C:\Windows\F2F7.tmp"C:\Windows\F2F7.tmp" \\.\pipe\{0ED00297-4FBE-4F40-8E15-5F250F4C534B}3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-