Resubmissions
13-12-2024 18:20
241213-wy6jaaxjh1 613-12-2024 18:17
241213-wxfw8sxjfs 1013-12-2024 18:14
241213-wvrwqaymam 813-12-2024 18:11
241213-ws1qvawrex 1013-12-2024 18:08
241213-wra4sswraw 813-12-2024 18:05
241213-wpj9paykdl 1013-12-2024 18:01
241213-wmcrtsyjfr 813-12-2024 17:59
241213-wkpcvayjbn 613-12-2024 17:56
241213-wjh5faxrgq 8General
-
Target
http://github.com
-
Sample
241213-wpj9paykdl
Malware Config
Targets
-
-
Target
http://github.com
Score10/10-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Badrabbit family
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
Modifies WinLogon for persistence
-
UAC bypass
-
mimikatz is an open source tool to dump credentials on Windows
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1