Analysis

  • max time kernel
    65s
  • max time network
    67s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-08-2024 20:41

Errors

Reason
Machine shutdown

General

  • Target

  • Size

    431KB

  • MD5

    fbbdc39af1139aebba4da004475e8839

  • SHA1

    de5c8d858e6e41da715dca1c019df0bfb92d32c0

  • SHA256

    630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

  • SHA512

    74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

  • SSDEEP

    12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in Windows directory 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:244
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4580
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3842220131 && exit"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3842220131 && exit"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3156
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 20:59:00
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 20:59:00
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4836
      • C:\Windows\BF39.tmp
        "C:\Windows\BF39.tmp" \\.\pipe\{BB6EF4E4-D9DD-4546-A3A2-9A786D5FFB14}
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3716
      • C:\Windows\SysWOW64\cmd.exe
        /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
        3⤵
          PID:4824
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Delete /F /TN drogon
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3104
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /F /TN drogon
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3380
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5000
      • C:\Users\Admin\Desktop\[email protected]
        "C:\Users\Admin\Desktop\[email protected]"
        1⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1120
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3040
      • C:\Users\Admin\Desktop\[email protected]
        "C:\Users\Admin\Desktop\[email protected]"
        1⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1576
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RestartRename.3g2"
        1⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1136
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3a2c855 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-3007475212-2160282277-2943627620-1000\ReadOnly\LockScreen_Z\LockScreen___1280_0720_notdimmed.jpg

        Filesize

        62KB

        MD5

        6cb7e9f13c79d1dd975a8aa005ab0256

        SHA1

        eac7fc28cc13ac1e9c85f828215cd61f0c698ae3

        SHA256

        af2537d470fddbeda270c965b8dbdf7e9ccf480ed2f525012e2f1035112a6d67

        SHA512

        3a40359d8e4cc8792be78a022dc04daed5c1cc55d78fe9cf3e061ea5587baa15023ce2152238f5be5cc5124cd468f220cf9dab54344d93edd3dfcd400b24469d

      • C:\Windows\BF39.tmp

        Filesize

        60KB

        MD5

        347ac3b6b791054de3e5720a7144a977

        SHA1

        413eba3973a15c1a6429d9f170f3e8287f98c21c

        SHA256

        301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

        SHA512

        9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

      • C:\Windows\infpub.dat

        Filesize

        401KB

        MD5

        1d724f95c61f1055f0d02c2154bbccd3

        SHA1

        79116fe99f2b421c52ef64097f0f39b815b20907

        SHA256

        579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

        SHA512

        f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

      • memory/1136-74-0x00007FFCEF120000-0x00007FFCEF154000-memory.dmp

        Filesize

        208KB

      • memory/1136-76-0x00007FFCDC420000-0x00007FFCDD4D0000-memory.dmp

        Filesize

        16.7MB

      • memory/1136-75-0x00007FFCDDEC0000-0x00007FFCDE176000-memory.dmp

        Filesize

        2.7MB

      • memory/1136-73-0x00007FF7E81F0000-0x00007FF7E82E8000-memory.dmp

        Filesize

        992KB

      • memory/1576-53-0x0000000002840000-0x00000000028A8000-memory.dmp

        Filesize

        416KB

      • memory/1576-60-0x0000000002840000-0x00000000028A8000-memory.dmp

        Filesize

        416KB

      • memory/1800-14-0x0000000002B00000-0x0000000002B68000-memory.dmp

        Filesize

        416KB

      • memory/1800-11-0x0000000002B00000-0x0000000002B68000-memory.dmp

        Filesize

        416KB

      • memory/1800-3-0x0000000002B00000-0x0000000002B68000-memory.dmp

        Filesize

        416KB

      • memory/3040-48-0x0000000000A40000-0x0000000000AA8000-memory.dmp

        Filesize

        416KB

      • memory/3040-40-0x0000000000A40000-0x0000000000AA8000-memory.dmp

        Filesize

        416KB