Extracted

Extracted

Extracted

• • Target
    FATALITY.exe
  • Size 1.1MB
  • SHA256 69bf67ee8d68ae0ef7bceabd834a01b503e4fe5c5ea8642614fe3e8c6e67486b
  • MD5 e8b6c4b6a33275622f7581b714665bc6
  • SHA1 5257b663ca6c47584863128b9387163c0f7dc5ed
  • SHA512 7145bbcde2eb9a6b7bd18ff24e79977e61dd67a52862c56046a1e58b5825fed4103233491983b16bd33276da70b91bfefd74b02935e9315a9208a5f7229f7f0a
  • SSDEEP 12288:vxxgliqhUyPGLm/NJIXAusHYs7cQ7g6wKg8QlXg0kDA:IhZeXVs4s7cgg6wKgjEA
  • TLSH
    T19D35C6146B808D09D910187FD1BE951CD73214F622027B033B5ABBBACEA5BEDED9C6D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebankercredential_accessdefense_evasiondiscoveryexecutionbadrabbitfantommazeramnitwannacryimpactpersistenceprivilege_escalationransomwarespywarestealersuricatatrojanupxworm

  • Family: BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom

  • Family: Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze

  • Family: Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (5428) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2