Extracted

Extracted

• • Target

    script-mad-city-7

  • Size

    7KB

  • MD5

    5d35c07aa73b879487f5f582f1eee2f7

  • SHA1

    9a239070b40e8a8d6fee6276c9bb4d7baf3267ac

  • SHA256

    fab320941a27be2dcce314470f9df44e72e3fa96432900a0bb5075453fda384b

  • SHA512

    16852de31ca0c9f5a4618cdfa2b113e2866ebca07c23fa8faa3ce13013da9ecec138df63c4043188496585f774abba0e81766cc26c6ecb9cc5c72eaa77388f31

  • SSDEEP

    192:PN2x2Bcu38+G1YCdjOGC4bdsgW8voy7m71TyPTN:AxHu38+GO+OGCkQ8Qy7mhWTN

  Score

  10^/10

  discoverybadrabbitdharmasporawannacrycredential_accessdefense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojanworm

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Badrabbit family

    badrabbit

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Spora

    Spora is a ransomware application that will encrypt files on a victim machine.

    trojanransomwarespora

  • Spora family

    spora

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Wannacry family

    wannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (550) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2