Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged/BadRabbit.exe
  • Size 431KB
  • SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
  • MD5 fbbdc39af1139aebba4da004475e8839
  • SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
  • SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
  • SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
  • TLSH
    T1199412426729EE92D1E1B8F84093E7CC4BB97B090FB991EF9D993485CC79B8319380D5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionbadrabbitmimikatzpersistenceransomware

  • Family: BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • mimikatz is an open source tool to dump credentials on Windows

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2
• • Target
    Red-Flaged/Petya.A.exe
  • Size 225KB
  • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
  • MD5 af2379cc4d607a45ac44d62135fb7015
  • SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
  • SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
  • SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
  • TLSH
    T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitpetyapersistenceransomware

  • Detects Petya Ransomware

    ransomware

  • Family: Petya

    Petya is a ransomware written in C#.

    ransomwarepetya

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral3behavioral4
• • Target
    Red-Flaged/WannaCrypt0r.exe
  • Size 3.4MB
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 84c82835a5d21bbcf75a61706d8ab549
  • SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
  • SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
  • SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
  • TLSH
    T173F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionwannacryimpactpersistenceprivilege_escalationransomwarespywarestealersuricataworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral5behavioral6