Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 08:26
General
-
Target
2024-04-20_31c8e3744f241a06e6c10507f70105fa_bad-rabbit_doublepulsar_eternalpetya_karagany_notpetya_petrwrap_petya.exe
-
Size
618KB
-
MD5
31c8e3744f241a06e6c10507f70105fa
-
SHA1
78ab7672f6b24ca6f7cf236d0609ab90d252b372
-
SHA256
6d4eb90e5ccaf6fe5a129ae6b1d84835bfbb500e2028420ff47e63c593b04ebc
-
SHA512
40e04a5c2d9fa6042e43865aa1de61893a24cc563ca84bf31e5b5a65c58ca3c987513675f50c3d89638240013a787fc1f34f84a387e3e1e8476b29074b312fdd
-
SSDEEP
12288:Wn/X4NTS/x9jNG+w+9OqFoK323qdQYKU3ZuGOBqs8XIJ25h5pYi:sXATS/x9jNg+95vdQaZAssGlhE
Score
9/10
Malware Config
Signatures
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 4 IoCs
-
Detects executables containing commands for clearing Windows Event Logs 4 IoCs
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_31c8e3744f241a06e6c10507f70105fa_bad-rabbit_doublepulsar_eternalpetya_karagany_notpetya_petrwrap_petya.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_31c8e3744f241a06e6c10507f70105fa_bad-rabbit_doublepulsar_eternalpetya_karagany_notpetya_petrwrap_petya.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 3362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 3442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2140 -ip 21401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2140 -ip 21401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
630KB
-
Filesize
20KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
630KB
-
Filesize
630KB
-
Filesize
144KB
-
Filesize
630KB
-
Filesize
144KB