Resubmissions
06/07/2024, 23:19
240706-3baawsygmg 7Analysis
-
max time kernel
368s -
max time network
426s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
06/07/2024, 23:19
Errors
General
-
Target
Bad Rabbit Erotic virtual pet DEMO.exe
-
Size
484.7MB
-
MD5
3ba77571c34faaa2c32ccb41fe4ea7e7
-
SHA1
7803dbb58187294970a499e7e2b50cb0c25337a0
-
SHA256
b54a055e351b7b02f64ba65002436a13ba6554b2c407966db0ef212c1a409646
-
SHA512
8ed9bb5e8d3ce5e7909f0937998ade8160e75af6f40f61bc56260871d9c571626e1c290dd2329f35080770ef82753072dfe64696f02bd0e1682d31f507dd1a3d
-
SSDEEP
12582912:FHQ4LuWERB+c9GVa2kPLsjy2856zaVO+G8ObDzp9YKNRpCGQ+OhHgIbcwf4QWqtr:FHQ4LuWERB+c9GVa2kPLsjy2856zaVOy
Malware Config
Signatures
-
Loads dropped DLL 10 IoCs
-
Drops file in Windows directory 5 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 15 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bad Rabbit Erotic virtual pet DEMO.exe"C:\Users\Admin\AppData\Local\Temp\Bad Rabbit Erotic virtual pet DEMO.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004B41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ConvertToExpand.rmi"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BBF85184-F482-4783-AE15-995AB7EEBF9B\dismhost.exeC:\Users\Admin\AppData\Local\Temp\BBF85184-F482-4783-AE15-995AB7EEBF9B\dismhost.exe {5D4A19E4-1848-461A-84FE-08C975134D4B}1⤵
- Drops file in Windows directory
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" EnterProductKey1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a28855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD515c1f5c080b99d1ea6f3b70c7a69af8c
SHA179e85e2d054dc6a07c0f9f611978e129e98ebf69
SHA256286605641cdba584c563d7241c106bc9ea9d3e5a22028ed92e7f5cabd33e1e4b
SHA512c540e8a1d1dfb60daec7694ff0f1cad210f7a061f80f6aea1a507b172a6295960c6ceaf80a808d1f752ec0ad8e4e97ad9941fd85c3926a4351095ae00aaaf1c7
-
Filesize
116KB
MD5620484ac56c6d8820f97f1b270780f4d
SHA10ffa10053fc6102662846c69c3caead76177d577
SHA256d96b7d91eebd3ae5f967d2726d00beb834be41a113aded49298da94cbdae48db
SHA512a8cbba36d670035fdda66ba2bda124963e27c2fbb23514f2f5c3d6775ba1ebafbe59494938cb6bf7e5f7cc8e949422c208f7e80124ca24af371ebe3b9234873f
-
Filesize
541KB
MD5839633898178f35f6de0b385b7de0ec7
SHA15396e52c45954f0953cc8cf2095b122f7353180e
SHA2565f6563d6bf2f3ceab8b2ca2c15ba4f7fe882a82c1f72b10041b5692c6515a53a
SHA512b0ed4fce2815dcb783e0b9a786178b337d215e6a4d16df1ddb3c28ccdba13081fee1976669d9f99505cf31b8f1e8d5584fd1aa9732e1add38217222726c76eb8
-
Filesize
1.5MB
MD5c85bcc9f3049b57aa8ccbb290342ff14
SHA138f5b81a540f1c995ff8d949702440b70921acc5
SHA256bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5
SHA5125097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7
-
Filesize
768KB
MD5200520e6e8b4d675b77971dfa9fb91b3
SHA10c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07
SHA256763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b
SHA5128b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b
-
Filesize
24KB
MD55bebc3ae0122702b89f9262888d3a393
SHA1064731c0f1d493b5b82921fa78f06e3d1db95284
SHA25681c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2
SHA512c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1
-
Filesize
8KB
MD557ea61dd14314ef155e80c6a0be8a664
SHA1963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
SHA25692a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
SHA512cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
2.7MB
-
Filesize
1.1MB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB