Overview

overview

10

Static

static

1

ADZP 20 Clean.bat

windows7-x64

1

ADZP 20 Clean.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ADZP 20 Clean.bat

  • Size

    13KB

  • Sample

    230622-3ry9ysbg8y

  • MD5

    c2c54b38738da1e8d48faf2e84594a99

  • SHA1

    2f7dcd0e047f0e293bb4f66c3f9839248d0bb194

  • SHA256

    d82719707e7358acaeb6380bbbe03379b8db2b6fce41febf4165f61539560d35

  • SHA512

    854f703d4fe92d47ce77b0818a23e449a16b09e42e7da03b8fd67db2f50c12c7731ea12dbf52767f6a59d7733fa8326415fb72ea2135d9bad3626c23b7bfae93

  • SSDEEP

    192:T6hhThhDhJhqmh0WxEuSEMRc1ojxwxpEutJWap3ahzbEuJp+U/JWap3ahzgMRcPj:RMEuSET6cEutJWo3yzbEu6U/JWo3yzg5

Score
10/10
badrabbitbootkitevasionpersistenceransomware

Malware Config

Targets

    • Target

      ADZP 20 Clean.bat

    • Size

      13KB

    • MD5

      c2c54b38738da1e8d48faf2e84594a99

    • SHA1

      2f7dcd0e047f0e293bb4f66c3f9839248d0bb194

    • SHA256

      d82719707e7358acaeb6380bbbe03379b8db2b6fce41febf4165f61539560d35

    • SHA512

      854f703d4fe92d47ce77b0818a23e449a16b09e42e7da03b8fd67db2f50c12c7731ea12dbf52767f6a59d7733fa8326415fb72ea2135d9bad3626c23b7bfae93

    • SSDEEP

      192:T6hhThhDhJhqmh0WxEuSEMRc1ojxwxpEutJWap3ahzbEuJp+U/JWap3ahzgMRcPj:RMEuSET6cEutJWo3yzbEu6U/JWo3yzg5

    Score
    10/10
    badrabbitbootkitevasionpersistenceransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Disables Task Manager via registry modification

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks