Overview

overview

10

Static

static

1

Download (35).mp4

windows10-2004-x64

10

Download (35).mp4

windows11-21h2-x64

7

Download (35).mp4

ubuntu-22.04-amd64

Download (35).mp4

debian-9-armhf

Download (35).mp4

debian-9-mips

Download (35).mp4

debian-9-mipsel

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Download (35).mp4

  • Size

    14.0MB

  • Sample

    250417-f2pf6ssrv3

  • MD5

    7f09d022359cded16c5f79858e62183d

  • SHA1

    c8c8041a68818ba5794b8fcb2fb97b5404269681

  • SHA256

    1f5859f23a8b5783f1fba87a0f87bdf26e07c13d5a273a5e9f947544d48a4b73

  • SHA512

    57b739bcb6416f83b0376d689edd6dcdb9ee6a7058f8e2cc614d4156481388afee45663de3267739fab91716aa29461078d60c7cc0d56e015de874af4ba955fa

  • SSDEEP

    393216:yTkXFbqHWUZLbzP18iBkTOTQvYKkfLH4Wo8tSiSo:y4XWWUZLbzPHTIYKkTH4Wo6b

Score
10/10
badrabbitcryptolockerdharmatroldeshcredential_accessdefense_evasiondiscoveryexecutionimpactlateral_movementlinuxpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Targets

    • Target

      Download (35).mp4

    • Size

      14.0MB

    • MD5

      7f09d022359cded16c5f79858e62183d

    • SHA1

      c8c8041a68818ba5794b8fcb2fb97b5404269681

    • SHA256

      1f5859f23a8b5783f1fba87a0f87bdf26e07c13d5a273a5e9f947544d48a4b73

    • SHA512

      57b739bcb6416f83b0376d689edd6dcdb9ee6a7058f8e2cc614d4156481388afee45663de3267739fab91716aa29461078d60c7cc0d56e015de874af4ba955fa

    • SSDEEP

      393216:yTkXFbqHWUZLbzP18iBkTOTQvYKkfLH4Wo8tSiSo:y4XWWUZLbzPHTIYKkTH4Wo6b

    Score
    10/10
    badrabbitcryptolockerdharmatroldeshcredential_accessdefense_evasiondiscoveryexecutionimpactlateral_movementpersistenceprivilege_escalationransomwarespywarestealertrojanupx

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Badrabbit family

      badrabbit

    • CryptoLocker

      Ransomware family with multiple variants.

      ransomwarecryptolocker

    • Cryptolocker family

      cryptolocker

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Dharma family

      dharma

    • Troldesh family

      troldesh

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Remote Service Session Hijacking: RDP Hijacking

      Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

      lateral_movement

    • Renames multiple (828) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Modifies Windows Firewall

      defense_evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Sets service image path in registry

      persistence

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Password Policy Discovery

      Attempt to access detailed information about the password policy used within an enterprise network.

      discovery

    • Drops file in System32 directory

    • Hide Artifacts: Hidden Users

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Direct Volume Access

1
T1006

Hide Artifacts

3
T1564

Hidden Files and Directories

2
T1564.001

Hidden Users

1
T1564.002

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Safe Mode Boot

1
T1562.009

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Password Policy Discovery

1
T1201

Peripheral Device Discovery

2
T1120

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Remote Service Session Hijacking

1
T1563

RDP Hijacking

1
T1563.002

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Tasks