Overview
overview
10Static
static
7Ransomware...er.exe
windows10-2004-x64
8Ransomware/7ev3n.exe
windows10-2004-x64
Ransomware...le.exe
windows10-2004-x64
Ransomware...it.exe
windows10-2004-x64
Ransomware/Birele.exe
windows10-2004-x64
10Ransomware...r5.exe
windows10-2004-x64
8Ransomware...us.exe
windows10-2004-x64
10Ransomware...er.exe
windows10-2004-x64
10Ransomware...ll.exe
windows10-2004-x64
7Ransomware...ck.exe
windows10-2004-x64
7Ransomware/Dharma.exe
windows10-2004-x64
9Ransomware/Fantom.exe
windows10-2004-x64
10Ransomware...ab.exe
windows10-2004-x64
10Ransomware...ye.exe
windows10-2004-x64
10Ransomware...Eye.js
windows10-2004-x64
10Ransomware...pt.exe
windows10-2004-x64
10Ransomware...en.exe
windows10-2004-x64
8Ransomware...AZ.dll
windows10-2004-x64
3Ransomware...om.exe
windows10-2004-x64
10Ransomware...ya.exe
windows10-2004-x64
10Ransomware...ap.exe
windows10-2004-x64
1Ransomware....A.exe
windows10-2004-x64
6Ransomware...om.exe
windows10-2004-x64
10Ransomware...nt.exe
windows10-2004-x64
Ransomware...ot.exe
windows10-2004-x64
Ransomware/RedEye.exe
windows10-2004-x64
Ransomware...re.exe
windows10-2004-x64
7Ransomware/Rokku.exe
windows10-2004-x64
10Ransomware/Satana.exe
windows10-2004-x64
5Ransomware/Seftad.exe
windows10-2004-x64
6Ransomware...re.exe
windows10-2004-x64
10Ransomware/UIWIX.dll
windows10-2004-x64
1Analysis
- max time kernel
907s - max time network
912s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
18/03/2024, 22:36
Behavioral task
behavioral1
Sample
Ransomware/$uckyLocker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Ransomware/7ev3n.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ransomware/Annabelle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Ransomware/BadRabbit.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Ransomware/Birele.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Ransomware/Cerber5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ransomware/CoronaVirus.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Ransomware/CryptoLocker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Ransomware/CryptoWall.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Ransomware/DeriaLock.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ransomware/Dharma.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Ransomware/Fantom.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ransomware/GandCrab.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Ransomware/GoldenEye/GoldenEye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ransomware/GoldenEye/GoldenEye.js
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Ransomware/InfinityCrypt.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Ransomware/Krotten.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Ransomware/Locky.AZ.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Ransomware/NoMoreRansom.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Ransomware/NotPetya.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Ransomware/PetrWrap.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Ransomware/Petya.A.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Ransomware/PolyRansom.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Ransomware/PowerPoint.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Ransomware/RedBoot.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Ransomware/RedEye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Ransomware/Rensenware.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Ransomware/Rokku.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Ransomware/Satana.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Ransomware/Seftad.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Ransomware/SporaRansomware.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Ransomware/UIWIX.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Errors
General
- Target Ransomware/BadRabbit.exe
- Size 431KB
- Sample240318-2h9hwsba88
- SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
- MD5 fbbdc39af1139aebba4da004475e8839
- SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
- SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
- SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
- Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 1260 fsutil.exe - Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Clears Windows event logs 1 TTPs 4 IoCs
pid Process 3024 wevtutil.exe 4860 wevtutil.exe 4368 wevtutil.exe 1860 wevtutil.exe - mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule behavioral4/files/0x000700000002322c-21.dat mimikatz - Blocklisted process makes network request 10 IoCs
flow pid Process 371 2008 rundll32.exe 392 2008 rundll32.exe 470 2008 rundll32.exe 512 2008 rundll32.exe 544 2008 rundll32.exe 572 2008 rundll32.exe 608 2008 rundll32.exe 651 2008 rundll32.exe 691 2008 rundll32.exe 726 2008 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 4516 57A5.tmp - Loads dropped DLL 1 IoCs
pid Process 2008 rundll32.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\infpub.dat BadRabbit.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\57A5.tmp rundll32.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3064 schtasks.exe 4468 schtasks.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 4516 57A5.tmp 4516 57A5.tmp 4516 57A5.tmp 4516 57A5.tmp 4516 57A5.tmp 4516 57A5.tmp 4516 57A5.tmp - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2008 rundll32.exe Token: SeDebugPrivilege 2008 rundll32.exe Token: SeTcbPrivilege 2008 rundll32.exe Token: SeDebugPrivilege 4516 57A5.tmp Token: SeSecurityPrivilege 3024 wevtutil.exe Token: SeBackupPrivilege 3024 wevtutil.exe Token: SeSecurityPrivilege 4860 wevtutil.exe Token: SeBackupPrivilege 4860 wevtutil.exe Token: SeSecurityPrivilege 4368 wevtutil.exe Token: SeBackupPrivilege 4368 wevtutil.exe Token: SeSecurityPrivilege 1860 wevtutil.exe Token: SeBackupPrivilege 1860 wevtutil.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4384 LogonUI.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3300 wrote to memory of 2008 3300 BadRabbit.exe 89 PID 3300 wrote to memory of 2008 3300 BadRabbit.exe 89 PID 3300 wrote to memory of 2008 3300 BadRabbit.exe 89 PID 2008 wrote to memory of 2468 2008 rundll32.exe 90 PID 2008 wrote to memory of 2468 2008 rundll32.exe 90 PID 2008 wrote to memory of 2468 2008 rundll32.exe 90 PID 2468 wrote to memory of 4420 2468 cmd.exe 92 PID 2468 wrote to memory of 4420 2468 cmd.exe 92 PID 2468 wrote to memory of 4420 2468 cmd.exe 92 PID 2008 wrote to memory of 2052 2008 rundll32.exe 96 PID 2008 wrote to memory of 2052 2008 rundll32.exe 96 PID 2008 wrote to memory of 2052 2008 rundll32.exe 96 PID 2008 wrote to memory of 4476 2008 rundll32.exe 98 PID 2008 wrote to memory of 4476 2008 rundll32.exe 98 PID 2008 wrote to memory of 4476 2008 rundll32.exe 98 PID 2052 wrote to memory of 3064 2052 cmd.exe 99 PID 2052 wrote to memory of 3064 2052 cmd.exe 99 PID 2052 wrote to memory of 3064 2052 cmd.exe 99 PID 2008 wrote to memory of 4516 2008 rundll32.exe 101 PID 2008 wrote to memory of 4516 2008 rundll32.exe 101 PID 4476 wrote to memory of 4468 4476 cmd.exe 103 PID 4476 wrote to memory of 4468 4476 cmd.exe 103 PID 4476 wrote to memory of 4468 4476 cmd.exe 103 PID 2008 wrote to memory of 4968 2008 rundll32.exe 128 PID 2008 wrote to memory of 4968 2008 rundll32.exe 128 PID 2008 wrote to memory of 4968 2008 rundll32.exe 128 PID 4968 wrote to memory of 3024 4968 cmd.exe 130 PID 4968 wrote to memory of 3024 4968 cmd.exe 130 PID 4968 wrote to memory of 3024 4968 cmd.exe 130 PID 4968 wrote to memory of 4860 4968 cmd.exe 131 PID 4968 wrote to memory of 4860 4968 cmd.exe 131 PID 4968 wrote to memory of 4860 4968 cmd.exe 131 PID 4968 wrote to memory of 4368 4968 cmd.exe 132 PID 4968 wrote to memory of 4368 4968 cmd.exe 132 PID 4968 wrote to memory of 4368 4968 cmd.exe 132 PID 4968 wrote to memory of 1860 4968 cmd.exe 133 PID 4968 wrote to memory of 1860 4968 cmd.exe 133 PID 4968 wrote to memory of 1860 4968 cmd.exe 133 PID 4968 wrote to memory of 1260 4968 cmd.exe 134 PID 4968 wrote to memory of 1260 4968 cmd.exe 134 PID 4968 wrote to memory of 1260 4968 cmd.exe 134 PID 2008 wrote to memory of 2576 2008 rundll32.exe 135 PID 2008 wrote to memory of 2576 2008 rundll32.exe 135 PID 2008 wrote to memory of 2576 2008 rundll32.exe 135
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware\BadRabbit.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware\BadRabbit.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:4420
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3134311576 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3134311576 && exit"4⤵
- Creates scheduled task(s)
PID:3064
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 23:01:003⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 23:01:004⤵
- Creates scheduled task(s)
PID:4468
-
-
-
C:\Windows\57A5.tmp"C:\Windows\57A5.tmp" \\.\pipe\{9C219611-910E-4DEB-9F24-EE9D0019B2B3}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Windows\SysWOW64\cmd.exe/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:3⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Setup4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl System4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Security4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Application4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\fsutil.exefsutil usn deletejournal /D C:4⤵
- Deletes NTFS Change Journal
PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN drogon3⤵PID:2576
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3884055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\57A5.tmp
- Size 60KB
- SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
- MD5 347ac3b6b791054de3e5720a7144a977
- SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
- SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
- SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\infpub.dat
- Size 265KB
- SHA256 99a0e2e3d09dcb6ca97813dcfa5b8c84edfc5c9323345e022e3004cafbd3b34f
- MD5 1b52b1a0384ee1b58f10ee72493a546b
- SHA1 1d28bc09698ff54ce33b7cf306b0578acea6c22c
- SHA512 28fb7e5ff75f4fec99de48807e7f4d2edc248acd3441db65d434587c318326b5e18de4d64157d984b06b73fe7e58d0b4d4a6f1bb907876c4613951f86c69f63f
- SSDEEP 6144:GWSND4t+jmehNTBi//cq4RCrZZKfA4gbdl4TSA80pf828k/q:GtDjvhNTc/cq4RKZZKfArRuSA80m+/q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\infpub.dat
- Size 64KB
- SHA256 392f1bf830cb12f3e8d49cee2f94ee7c0defa785bf04b06794223e058e1a0535
- MD5 1d12b78268144bc10cb270fd514c7a71
- SHA1 50e1c0574cf417527111f0d01a3b93fd2c3e0a28
- SHA512 59b04f5721fd895207e3bed8f01ded02dea7c4d15752791e434c695615dab0273bcb8362d4470682c7c6098d17917f0ba547fa1d6801a6aca7f5b9e00b9a381f
- SSDEEP 1536:4z06QGQKAyND4zQ7r3RDUn+mgAhfRpeMEIOlnToIf3:GWSND4YW+mgA53ehNTBf3
- MD5 SHA1 SHA512 SSDEEP