Resubmissions

09-05-2024 20:23

240509-y58y4afh39 1

03-05-2024 11:30

240503-nl9feafd78 10

03-05-2024 11:28

240503-nlhbxsfd55 4

03-05-2024 11:25

240503-nh81gadc71 10

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

  • Sample

    240503-nl9feafd78

Malware Config

Targets

    • Target

      https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

    • mimikatz is an open source tool to dump credentials on Windows

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Command and Control

Web Service

1
T1102

Tasks