Analysis
-
max time kernel
148s -
max time network
58s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-05-2021 00:19
Static task
static1
Behavioral task
behavioral1
Sample
GiftCardsGenerator.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
GiftCardsGenerator.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
GiftCardsGenerator.exe
-
Size
431KB
-
MD5
fbbdc39af1139aebba4da004475e8839
-
SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0
-
SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
-
SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
Score
10/10
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Executes dropped EXE 1 IoCs
pid Process 1148 6661.tmp -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\infpub.dat GiftCardsGenerator.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\6661.tmp rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 788 schtasks.exe 632 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1756 rundll32.exe 1756 rundll32.exe 1148 6661.tmp 1148 6661.tmp 1148 6661.tmp 1148 6661.tmp 1148 6661.tmp 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 1756 rundll32.exe Token: SeDebugPrivilege 1756 rundll32.exe Token: SeTcbPrivilege 1756 rundll32.exe Token: SeDebugPrivilege 1148 6661.tmp Token: SeDebugPrivilege 1172 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe 1172 taskmgr.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1756 2044 GiftCardsGenerator.exe 29 PID 2044 wrote to memory of 1756 2044 GiftCardsGenerator.exe 29 PID 2044 wrote to memory of 1756 2044 GiftCardsGenerator.exe 29 PID 2044 wrote to memory of 1756 2044 GiftCardsGenerator.exe 29 PID 2044 wrote to memory of 1756 2044 GiftCardsGenerator.exe 29 PID 2044 wrote to memory of 1756 2044 GiftCardsGenerator.exe 29 PID 2044 wrote to memory of 1756 2044 GiftCardsGenerator.exe 29 PID 1756 wrote to memory of 1544 1756 rundll32.exe 31 PID 1756 wrote to memory of 1544 1756 rundll32.exe 31 PID 1756 wrote to memory of 1544 1756 rundll32.exe 31 PID 1756 wrote to memory of 1544 1756 rundll32.exe 31 PID 1544 wrote to memory of 836 1544 cmd.exe 33 PID 1544 wrote to memory of 836 1544 cmd.exe 33 PID 1544 wrote to memory of 836 1544 cmd.exe 33 PID 1544 wrote to memory of 836 1544 cmd.exe 33 PID 1756 wrote to memory of 1016 1756 rundll32.exe 34 PID 1756 wrote to memory of 1016 1756 rundll32.exe 34 PID 1756 wrote to memory of 1016 1756 rundll32.exe 34 PID 1756 wrote to memory of 1016 1756 rundll32.exe 34 PID 1016 wrote to memory of 632 1016 cmd.exe 36 PID 1016 wrote to memory of 632 1016 cmd.exe 36 PID 1016 wrote to memory of 632 1016 cmd.exe 36 PID 1016 wrote to memory of 632 1016 cmd.exe 36 PID 1756 wrote to memory of 1816 1756 rundll32.exe 37 PID 1756 wrote to memory of 1816 1756 rundll32.exe 37 PID 1756 wrote to memory of 1816 1756 rundll32.exe 37 PID 1756 wrote to memory of 1816 1756 rundll32.exe 37 PID 1816 wrote to memory of 788 1816 cmd.exe 39 PID 1816 wrote to memory of 788 1816 cmd.exe 39 PID 1816 wrote to memory of 788 1816 cmd.exe 39 PID 1816 wrote to memory of 788 1816 cmd.exe 39 PID 1756 wrote to memory of 1148 1756 rundll32.exe 40 PID 1756 wrote to memory of 1148 1756 rundll32.exe 40 PID 1756 wrote to memory of 1148 1756 rundll32.exe 40 PID 1756 wrote to memory of 1148 1756 rundll32.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\GiftCardsGenerator.exe"C:\Users\Admin\AppData\Local\Temp\GiftCardsGenerator.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:836
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 408178528 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 408178528 && exit"4⤵
- Creates scheduled task(s)
PID:632
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:42:003⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 02:42:004⤵
- Creates scheduled task(s)
PID:788
-
-
-
C:\Windows\6661.tmp"C:\Windows\6661.tmp" \\.\pipe\{2D728DC2-C6F1-4EE2-AC8E-8C7C23D36842}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1172