Overview

overview

10

Static

static

10

2024-04-26...ry.exe

windows7-x64

10

2024-04-26...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-04-26_cfff3d6a65ed27626da9ce130ff1203c_bad-rabbit_cerber_eternalpetya_metamorfo_petya_wannacry

  • Size

    9.8MB

  • Sample

    240426-bt52qsha29

  • MD5

    cfff3d6a65ed27626da9ce130ff1203c

  • SHA1

    c8113686f28a88541d097e56bd877e7decf70f73

  • SHA256

    92e764fc16284e034e7608c2edd404537b5f1ed18e6ec55a42e9bf3cffa904dd

  • SHA512

    9ebe5fda4dc820a9212dcbf30326656fa5303ecb8c89bbd49043168d2c4b5bb755e6dad8c468886d885a6a4bf8a8357ea642415626ef7025703cfb81c0af96a3

  • SSDEEP

    196608:8BPgnBgF6nnXAqPe1Cxcxk3ZAEUadzR8yc4gw7mLqFRb2HxH:9nBgF6nQqG1Fxk3mEUadzRURfqHAR

Score
10/10
badrabbitmimikatzransomware

Malware Config

Targets

    • Target

      2024-04-26_cfff3d6a65ed27626da9ce130ff1203c_bad-rabbit_cerber_eternalpetya_metamorfo_petya_wannacry

    • Size

      9.8MB

    • MD5

      cfff3d6a65ed27626da9ce130ff1203c

    • SHA1

      c8113686f28a88541d097e56bd877e7decf70f73

    • SHA256

      92e764fc16284e034e7608c2edd404537b5f1ed18e6ec55a42e9bf3cffa904dd

    • SHA512

      9ebe5fda4dc820a9212dcbf30326656fa5303ecb8c89bbd49043168d2c4b5bb755e6dad8c468886d885a6a4bf8a8357ea642415626ef7025703cfb81c0af96a3

    • SSDEEP

      196608:8BPgnBgF6nnXAqPe1Cxcxk3ZAEUadzR8yc4gw7mLqFRb2HxH:9nBgF6nQqG1Fxk3mEUadzRURfqHAR

    Score
    10/10
    badrabbitmimikatzransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks