Extracted

• • Target

    000.exe

  • Size

    6.7MB

  • MD5

    f2b7074e1543720a9a98fda660e02688

  • SHA1

    1029492c1a12789d8af78d54adcb921e24b9e5ca

  • SHA256

    4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

  • SHA512

    73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

  • SSDEEP

    3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9

  Score

  8^/10

  evasionpersistenceransomware

  • Disables Task Manager via registry modification

    evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2

• • Target

    Ana.exe

  • Size

    2.1MB

  • MD5

    f571faca510bffe809c76c1828d44523

  • SHA1

    7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2

  • SHA256

    117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb

  • SHA512

    a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51

  • SSDEEP

    49152:OwVYlfBUDiZx8Fa/Q0NuB3btlnCItWNSwoy:OxPUDQmso0NuBZlnCItM

  Score

  7^/10

  bootkitdiscoveryevasionpersistencetrojanupx

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral3behavioral4

• • Target

    Bad Rabit.exe

  • Size

    431KB

  • MD5

    fbbdc39af1139aebba4da004475e8839

  • SHA1

    de5c8d858e6e41da715dca1c019df0bfb92d32c0

  • SHA256

    630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

  • SHA512

    74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

  • SSDEEP

    12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

  Score

  10^/10

  badrabbitmimikatzransomware

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral5behavioral6

• • Target

    D34TH 2.0 .bat

  • Size

    1KB

  • MD5

    8ee9033a02ee6fc3b932b694c1bc631c

  • SHA1

    6d64ea5dadd6d5098342213a1cf354896b8a3963

  • SHA256

    1609a6c649ea074815ce85da21935137e9c79c79a41088a6f7e99a56bd20340d

  • SHA512

    f1735b2a7f4b384cf3a82f17e2834912f04d554350d6a03dd1ff6b55efb161e900ae14bd1c337f40d4692d390a726219c85d3a8df6164bac73e2f5c3d38d6a91

  Score

  8^/10

  discoveryevasion

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions

    discovery

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory

  • Modifies termsrv.dll

    Commonly used to allow simultaneous RDP sessions.

  behavioral7behavioral8

• • Target

    DDOS.bat

  • Size

    151B

  • MD5

    912557eed9e6f6098b3033aaf310b697

  • SHA1

    9c05231febc2325be23d267d2bba302ac7489872

  • SHA256

    cf9f511f61b544299c5812abc0e524b9bd887acb2294fbec085515609b3ed44d

  • SHA512

    f196e8055901b56e3a6bae734bff40d28edd4fbbe21f51135c7a0cbab7d3d5bf41f59528bf434e557b49d943c881c13fc6ada2f2d263d4f660de3585117e58fe

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral10behavioral9

• • Target

    Desktop Puzzle.exe

  • Size

    239KB

  • MD5

    2f8f6e90ca211d7ef5f6cf3c995a40e7

  • SHA1

    f8940f280c81273b11a20d4bfb43715155f6e122

  • SHA256

    1f5a26f24a2bfdd301008f0cc51a6c3762f41b926f974c814f1ecaa4cb28e5e6

  • SHA512

    2b38475550edee5519e33bd18fea510ad73345a27c20f6457710498d34e3d0cf05b0f96f32d018e7dc154a6f2232ea7e3145fd0ed5fb498f9e4702a4be1bb9c8

  • SSDEEP

    3072:r/3qftCdbSFtY8Zf8pOk0rHitNWIekbnfFPsr24Cv/Eng9m3ihlCeKH6Fb6aX3WA:WoI/rC0k7ar68nimCYHe3qZr0SlC

  Score

  1^/10
  behavioral11behavioral12

• • Target

    Memz.exe

  • Size

    14KB

  • MD5

    19dbec50735b5f2a72d4199c4e184960

  • SHA1

    6fed7732f7cb6f59743795b2ab154a3676f4c822

  • SHA256

    a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

  • SHA512

    aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

  • SSDEEP

    192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

  Score

  7^/10

  bootkitpersistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral13behavioral14

• • Target

    NoEscape.exe

  • Size

    666KB

  • MD5

    989ae3d195203b323aa2b3adf04e9833

  • SHA1

    31a45521bc672abcf64e50284ca5d4e6b3687dc8

  • SHA256

    d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f

  • SHA512

    e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305

  • SSDEEP

    12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t

  Score

  10^/10

  evasionpersistenceransomwaretrojan

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Modifies WinLogon

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral15behavioral16

• • Target

    Phantom Crypter.bat

  • Size

    5KB

  • MD5

    86048f27a743bfd1c7e50fc611e50047

  • SHA1

    3ff7974076f5b600fd7bddf0b0b1cf98247d46c3

  • SHA256

    2d07538b05f785bec00733dd27374d46411042344c08a847f9f0ce297479cb6e

  • SHA512

    84e5b6ce2ecb65fc4f294f1a940ce76ab8f929e619ff5659040a082a4d55bf0be047884c8111d4aa0482131919611590e4c9ab4aa2e88ccb6ffe508a85f48bfe

  • SSDEEP

    96:1E2FFXpOnWvbClLy2Ju7y5KQZ2Ju7y5KJ:1E2VbClLyX7ycCX7ycJ

  Score

  8^/10

  discoveryevasion

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Modifies file permissions

    discovery

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory

  behavioral17behavioral18

• • Target

    WannaCrypt0r.exe

  • Size

    3.4MB

  • MD5

    84c82835a5d21bbcf75a61706d8ab549

  • SHA1

    5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

  • SHA512

    90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

  • SSDEEP

    98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

  Score

  10^/10

  wannacrydiscoverypersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral19behavioral20

• • Target

    infinite locker.bat

  • Size

    1KB

  • MD5

    ee64ffe8afb7ae50a94654b29b18e805

  • SHA1

    845b1d1841eaebc4cf87f796ff272595b82b0a99

  • SHA256

    0c2401442ccedb4cecb194044cd5c8893ae44ad84f549c4d9007a78153e26f40

  • SHA512

    22bad3b85221af74cb931a6e358c6eb11ede54536c0bdf6a1f848589981a4608e4c2e41bf348fbbc3390026f206a6fcf899ea2877d19a402169e801bd3ec103b

  Score

  7^/10

  discovery

  • Modifies file permissions

    discovery
  behavioral21behavioral22