Overview

overview

10

Static

static

10

2024-04-20...ya.exe

windows7-x64

10

2024-04-20...ya.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-20_31c8e3744f241a06e6c10507f70105fa_bad-rabbit_doublepulsar_eternalpetya_karagany_notpetya_petrwrap_petya

  • Size

    618KB

  • Sample

    240420-kbypdadb6y

  • MD5

    31c8e3744f241a06e6c10507f70105fa

  • SHA1

    78ab7672f6b24ca6f7cf236d0609ab90d252b372

  • SHA256

    6d4eb90e5ccaf6fe5a129ae6b1d84835bfbb500e2028420ff47e63c593b04ebc

  • SHA512

    40e04a5c2d9fa6042e43865aa1de61893a24cc563ca84bf31e5b5a65c58ca3c987513675f50c3d89638240013a787fc1f34f84a387e3e1e8476b29074b312fdd

  • SSDEEP

    12288:Wn/X4NTS/x9jNG+w+9OqFoK323qdQYKU3ZuGOBqs8XIJ25h5pYi:sXATS/x9jNg+95vdQaZAssGlhE

Score
10/10
mimikatzbootkitpersistencespywarestealer

Malware Config

Targets

    • Target

      2024-04-20_31c8e3744f241a06e6c10507f70105fa_bad-rabbit_doublepulsar_eternalpetya_karagany_notpetya_petrwrap_petya

    • Size

      618KB

    • MD5

      31c8e3744f241a06e6c10507f70105fa

    • SHA1

      78ab7672f6b24ca6f7cf236d0609ab90d252b372

    • SHA256

      6d4eb90e5ccaf6fe5a129ae6b1d84835bfbb500e2028420ff47e63c593b04ebc

    • SHA512

      40e04a5c2d9fa6042e43865aa1de61893a24cc563ca84bf31e5b5a65c58ca3c987513675f50c3d89638240013a787fc1f34f84a387e3e1e8476b29074b312fdd

    • SSDEEP

      12288:Wn/X4NTS/x9jNG+w+9OqFoK323qdQYKU3ZuGOBqs8XIJ25h5pYi:sXATS/x9jNg+95vdQaZAssGlhE

    Score
    10/10
    mimikatzbootkitpersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware

    • Detects executables containing commands for clearing Windows Event Logs

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks