General
-
Target
BadRabbit.zip
-
Size
393KB
-
Sample
230604-scp3madb4w
-
MD5
61da9939db42e2c3007ece3f163e2d06
-
SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb
-
SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa
-
SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e
-
SSDEEP
12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6
Static task
static1
Behavioral task
behavioral1
Sample
BadRabbit.zip
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\Users\Admin\Downloads\WannaCrypt0r\@Please_Read_Me@.txt
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Targets
-
-
Target
BadRabbit.zip
-
Size
393KB
-
MD5
61da9939db42e2c3007ece3f163e2d06
-
SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb
-
SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa
-
SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e
-
SSDEEP
12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-