Bad Rabbit Ransomware | VTI by Category
Try VMRay Analyzer
|
VTI Score
100 / 100
|
|
| VTI Database Version | 2.6 |
| VTI Rule Match Count | 24 |
| VTI Rule Type | Default (PE, ...) |
|
Anti Analysis |
|
|
|
Dynamic API usage
|
|
|
Resolve above average number of APIs.
|
||
|
|
Delay execution
|
|
|
One thread sleeps more than 5 minutes.
|
||
|
|
Device |
|
|
|
Control device
|
|
|
Control device "\\.\dcrypt" through API DeviceIOControl.
|
||
|
Control device "\\.\GLOBALROOT\ArcName\multi(0)disk(0)rdisk(0)partition(1)" through API DeviceIOControl.
|
||
|
Control device "\\.\PhysicalDrive0" through API DeviceIOControl.
|
||
|
|
Access physical drive
|
|
|
Access physical drive "\device\harddisk0\dr0".
|
||
|
|
File System |
|
|
|
Encrypt content of user files
|
|
|
Encrypt the content of multiple user files. This is an indicator for ransomware.
|
||
|
|
Modify operating system directory
|
|
|
Create file "C:\Windows\infpub.dat" in the OS directory.
|
||
|
Create file "C:\Windows\cscc.dat" in the OS directory.
|
||
|
Create file "C:\Windows\dispci.exe" in the OS directory.
|
||
|
Create file "C:\Windows\41D0.tmp" in the OS directory.
|
||
|
|
Kernel |
|
|
|
Execute code with kernel privileges
|
|
|
Execute code with kernel privileges.
|
||
|
|
PE |
|
|
|
Drop PE file
|
|
|
Drop file "c:\windows\infpub.dat".
|
||
|
Drop file "c:\windows\cscc.dat".
|
||
|
Drop file "c:\windows\dispci.exe".
|
||
|
Drop file "c:\windows\41d0.tmp".
|
||
|
|
Execute dropped PE file
|
|
|
Execute dropped file "c:\windows\dispci.exe".
|
||
|
Execute dropped file "c:\windows\41d0.tmp".
|
||
|
|
Persistence |
|
|
|
Install kernel driver
|
|
|
Install signed kernel driver with service name "cscc".
|
||
|
|
Process |
|
|
|
Create process with hidden window
|
|
|
The process "C:\Windows\system32\rundll32.exe" starts with hidden window.
|
||
|
The process "C:\Windows\system32\cmd.exe" starts with hidden window.
|
||
|
The process "C:\Windows\41D0.tmp" starts with hidden window.
|
||
|
|
Create system object
|
|
|
Create mutex with name "9A1966663AD6FDE5".
|
||
|
|
Read from memory of another process
|
|
|
"c:\windows\41d0.tmp" reads from "c:\windows\system32\lsass.exe".
|
||
| - | Browser | |
| - | OS | |
| - | Hide Tracks | |
| - | Information Stealing | |
| - | Injection | |
| - | Masquerade | |
| - | Network | |
| - | User | |
| - | VBA Macro | |
| - | YARA | |
