c49eb3f83f94347d223338a13a2a57387ac689dc16d64f3d41a251b3a3325e5d

General

Target

Badboymnb.exe
Size

23KB
MD5

0bf3158979d38b3d3c99ccfa5b1b4a83
SHA1

f8eb3e0ab7f09eb93125afa11d5c793f55e1c607
SHA256

c49eb3f83f94347d223338a13a2a57387ac689dc16d64f3d41a251b3a3325e5d
SHA512

938b82fde3e7bddb96948d9548ebd325dd63fb01292a8a8fcb22e102b51bee66143be21d24c18d9e9a6b6c2518e82992e056fccf4fa7492938ffe8848bcc096a

Score

10^/10

ransomware persistence spyware

Malware Config

Extracted

Path

C:\ReadME-BadboyEncryption.txt

Ransom Note

All your data has been locked us. You want to return? Contact to Email: alix1011@protonmail.com Your Personal Key : XAprJY8ac0+cVEBkFYgVr+VkOi202U1+SQ9Gzjiiromns6vCNr0LmOMdfZXg+4hYnReYaasB+w/zzcBBhbpBxO0tjjNhaE0+wRlRU15rlr0SbjT6xdOWrN+YTY3apPIYYmcSqS9avpXOTciB7JYf+lDZo2TqXo2fzoXsvryAS/nveamiHwSfjr/VIdce7TJBnhlchwLX39/ryUD6quyhSGwbd3owAnrwY8RAPKw6f/1fERynPdxXcW8uKlCMGEjTNWsD+Zg8aGKDXFyVcNWcJAjrjG92P8pCaMzw0JZ0QwMjN5wOLiOtHxWtqrAptEyy7DHurg0jV6LyB+xKULklLg==

Emails

alix1011@protonmail.com

Signatures

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1960 vssadmin.exe

pid	process
1960	vssadmin.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops desktop.ini file(s) 83 IoCs

Processes:

Badboymnb.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\IQD6DIKV\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Libraries\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Pictures\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Favorites\Links for United States\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Searches\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Documents\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Pictures\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Videos\Sample Videos\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Videos\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Videos\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Music\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OT4YD26O\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Links\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	Badboymnb.exe
File created	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Desktop\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\LUBVL9MG\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Music\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XGJ27KX4\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Badboymnb.exe
File created	C:\Users\Public\Music\Sample Music\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Q8AAMSB\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZDAW0I3Y\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1IGGBW8Z\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Contacts\desktop.ini	Badboymnb.exe
File created	C:\Users\Admin\Favorites\desktop.ini	Badboymnb.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	Badboymnb.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	Badboymnb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Drops startup file 1 IoCs

Processes:

Badboymnb.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Badboymnb.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Badboymnb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Badboymnb.execmd.exe

description	pid	process	target process
PID 828 wrote to memory of 1948	828	Badboymnb.exe	cmd.exe
PID 828 wrote to memory of 1948	828	Badboymnb.exe	cmd.exe
PID 828 wrote to memory of 1948	828	Badboymnb.exe	cmd.exe
PID 828 wrote to memory of 1948	828	Badboymnb.exe	cmd.exe
PID 1948 wrote to memory of 1960	1948	cmd.exe	vssadmin.exe
PID 1948 wrote to memory of 1960	1948	cmd.exe	vssadmin.exe
PID 1948 wrote to memory of 1960	1948	cmd.exe	vssadmin.exe
PID 1948 wrote to memory of 1960	1948	cmd.exe	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1936 vssvc.exe
Token: SeRestorePrivilege 1936 vssvc.exe
Token: SeAuditPrivilege 1936 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1936	vssvc.exe
Token: SeRestorePrivilege	1936	vssvc.exe
Token: SeAuditPrivilege	1936	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\Badboymnb.exe
"C:\Users\Admin\AppData\Local\Temp\Badboymnb.exe"
1⤵
- Drops desktop.ini file(s)
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:828