Extracted

• • Target
    .
  • Size 563KB
  • SHA256 1dea18d80006e9b39df1e7bbb5ce55be4da11c1bd69ad6ce87d4fa09985b6219
  • MD5 9dc6bd01c72aadaa9182ca964f8a5d24
  • SHA1 5798a00c4e61243526bd5befd93ecc1c639dc6b0
  • SHA512 ab7f6be0a92b76565b849f86d84e9453e63197aa0ee11afe37e94026d3b3b4ba4bcd45a460671063c68ef041f800521119faafa88501ab2bcc6d96897437de28
  • SSDEEP 12288:V+pZbpAj/2db+J/BghCv0Rtw/sN2HPPUTKPz3KQ4ZZxoGfol48PSBPD365nCwGJN:V+j
  • TLSH
    T18EC40BE6B0B1D735158E53EBF0F16A10E2E3199AC3439DD9C11CCB4885C989CF6A36A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionbadrabbitdharmamimikatzimpactpersistenceprivilege_escalationransomwarespywarestealersuricatatrojan

  • Family: BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Family: Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • mimikatz is an open source tool to dump credentials on Windows

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (421) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  behavioral1