Bad Rabbit Ransomware | VTI by Score
Try VMRay Analyzer
|
VTI Score
100 / 100
|
|
| VTI Database Version | 2.6 |
| VTI Rule Match Count | 24 |
| VTI Rule Type | Default (PE, ...) |
|
File System | Encrypt content of user files |
|
|
Encrypt the content of multiple user files. This is an indicator for ransomware.
|
|||
|
|
Kernel | Execute code with kernel privileges |
|
|
Execute code with kernel privileges.
|
|||
|
|
Device | Control device |
|
|
Control device "\\.\dcrypt" through API DeviceIOControl.
|
|||
|
Control device "\\.\GLOBALROOT\ArcName\multi(0)disk(0)rdisk(0)partition(1)" through API DeviceIOControl.
|
|||
|
Control device "\\.\PhysicalDrive0" through API DeviceIOControl.
|
|||
|
|
Device | Access physical drive |
|
|
Access physical drive "\device\harddisk0\dr0".
|
|||
|
|
File System | Modify operating system directory |
|
|
Create file "C:\Windows\infpub.dat" in the OS directory.
|
|||
|
Create file "C:\Windows\cscc.dat" in the OS directory.
|
|||
|
Create file "C:\Windows\dispci.exe" in the OS directory.
|
|||
|
Create file "C:\Windows\41D0.tmp" in the OS directory.
|
|||
|
|
Process | Create process with hidden window |
|
|
The process "C:\Windows\system32\rundll32.exe" starts with hidden window.
|
|||
|
The process "C:\Windows\system32\cmd.exe" starts with hidden window.
|
|||
|
The process "C:\Windows\41D0.tmp" starts with hidden window.
|
|||
|
|
Anti Analysis | Dynamic API usage |
|
|
Resolve above average number of APIs.
|
|||
|
|
Process | Create system object |
|
|
Create mutex with name "9A1966663AD6FDE5".
|
|||
|
|
Persistence | Install kernel driver |
|
|
Install signed kernel driver with service name "cscc".
|
|||
|
|
Process | Read from memory of another process |
|
|
"c:\windows\41d0.tmp" reads from "c:\windows\system32\lsass.exe".
|
|||
|
|
Anti Analysis | Delay execution |
|
|
One thread sleeps more than 5 minutes.
|
|||
|
|
PE | Drop PE file |
|
|
Drop file "c:\windows\infpub.dat".
|
|||
|
Drop file "c:\windows\cscc.dat".
|
|||
|
Drop file "c:\windows\dispci.exe".
|
|||
|
Drop file "c:\windows\41d0.tmp".
|
|||
|
|
PE | Execute dropped PE file |
|
|
Execute dropped file "c:\windows\dispci.exe".
|
|||
|
Execute dropped file "c:\windows\41d0.tmp".
|
|||
