Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-05-2021 00:19
Static task
static1
Behavioral task
behavioral1
Sample
GiftCardsGenerator.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
GiftCardsGenerator.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
GiftCardsGenerator.exe
-
Size
431KB
-
MD5
fbbdc39af1139aebba4da004475e8839
-
SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0
-
SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
-
SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
Score
10/10
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4336 created 3688 4336 WerFault.exe 103 -
Executes dropped EXE 1 IoCs
pid Process 3308 25AE.tmp -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConnectUnprotect.tiff rundll32.exe File opened for modification C:\Users\Admin\Pictures\ExportShow.tiff rundll32.exe File opened for modification C:\Users\Admin\Pictures\WriteRestore.tiff rundll32.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\infpub.dat GiftCardsGenerator.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\25AE.tmp rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4336 3688 WerFault.exe 103 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1908 schtasks.exe 3636 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\LowRegistry PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions PaintStudio.View.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200" PaintStudio.View.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3688 PaintStudio.View.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1428 rundll32.exe 1428 rundll32.exe 1428 rundll32.exe 1428 rundll32.exe 3308 25AE.tmp 3308 25AE.tmp 3308 25AE.tmp 3308 25AE.tmp 3308 25AE.tmp 3308 25AE.tmp 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3656 mspaint.exe 3656 mspaint.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 1428 rundll32.exe Token: SeDebugPrivilege 1428 rundll32.exe Token: SeTcbPrivilege 1428 rundll32.exe Token: SeDebugPrivilege 3308 25AE.tmp Token: SeDebugPrivilege 3944 taskmgr.exe Token: SeSystemProfilePrivilege 3944 taskmgr.exe Token: SeCreateGlobalPrivilege 3944 taskmgr.exe Token: 33 3944 taskmgr.exe Token: SeIncBasePriorityPrivilege 3944 taskmgr.exe Token: SeDebugPrivilege 3688 PaintStudio.View.exe Token: SeDebugPrivilege 3688 PaintStudio.View.exe Token: SeDebugPrivilege 3688 PaintStudio.View.exe Token: SeDebugPrivilege 4336 WerFault.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3656 mspaint.exe 3688 PaintStudio.View.exe 3688 PaintStudio.View.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 500 wrote to memory of 1428 500 GiftCardsGenerator.exe 76 PID 500 wrote to memory of 1428 500 GiftCardsGenerator.exe 76 PID 500 wrote to memory of 1428 500 GiftCardsGenerator.exe 76 PID 1428 wrote to memory of 2432 1428 rundll32.exe 77 PID 1428 wrote to memory of 2432 1428 rundll32.exe 77 PID 1428 wrote to memory of 2432 1428 rundll32.exe 77 PID 2432 wrote to memory of 3664 2432 cmd.exe 79 PID 2432 wrote to memory of 3664 2432 cmd.exe 79 PID 2432 wrote to memory of 3664 2432 cmd.exe 79 PID 1428 wrote to memory of 3860 1428 rundll32.exe 81 PID 1428 wrote to memory of 3860 1428 rundll32.exe 81 PID 1428 wrote to memory of 3860 1428 rundll32.exe 81 PID 1428 wrote to memory of 3712 1428 rundll32.exe 83 PID 1428 wrote to memory of 3712 1428 rundll32.exe 83 PID 1428 wrote to memory of 3712 1428 rundll32.exe 83 PID 1428 wrote to memory of 3308 1428 rundll32.exe 84 PID 1428 wrote to memory of 3308 1428 rundll32.exe 84 PID 3860 wrote to memory of 1908 3860 cmd.exe 87 PID 3860 wrote to memory of 1908 3860 cmd.exe 87 PID 3860 wrote to memory of 1908 3860 cmd.exe 87 PID 3712 wrote to memory of 3636 3712 cmd.exe 88 PID 3712 wrote to memory of 3636 3712 cmd.exe 88 PID 3712 wrote to memory of 3636 3712 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\GiftCardsGenerator.exe"C:\Users\Admin\AppData\Local\Temp\GiftCardsGenerator.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Modifies extensions of user files
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:3664
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 423076137 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 423076137 && exit"4⤵
- Creates scheduled task(s)
PID:1908
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:41:003⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:41:004⤵
- Creates scheduled task(s)
PID:3636
-
-
-
C:\Windows\25AE.tmp"C:\Windows\25AE.tmp" \\.\pipe\{7A93BF75-2EC8-4F88-AB17-1119A8671D95}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3944
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\WatchFormat.jfif" /ForceBootstrapPaint3D1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3656
-
C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3688 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3688 -s 43202⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4620