Extracted

• • Target

    dyv.png

  • Size

    1.8MB

  • MD5

    11b7bbb67f673539b5a2c0f2962e3a80

  • SHA1

    7049f78608ddf8fcfedbf24724bcaf92794866f3

  • SHA256

    ec21bc5f665662e4492b99aaae389f5a132619ef73631118b6e2d3a3a231e275

  • SHA512

    c21d38a50fd8e4bec8027c6bd103d81b354afd2c1e1fdc581d016a40eaf9ffa879d50a39361dd36a8bf0197685161173b154c7902e8e861bb835bbbd79ba0b87

  • SSDEEP

    49152:oJkPBnd7Ez7fqZxqjbfb66iezYy/0eSOYseXW58n5:oJEEz7QxqjbOnezYy/ZVYXW58n5

  Score

  10^/10

  bootkitdiscoverymotwpersistencephishingspywarestealerbadrabbitinfinitylockwannacryagilenetdefense_evasionevasionexecutionimpactransomwaretrojanworm

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Badrabbit family

    badrabbit

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock

  • Infinitylock family

    infinitylock

  • UAC bypass

    evasiontrojan

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • A potential corporate email address has been identified in the URL: 1=@K

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2