badrabbit | f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Target

[email protected]
Size

762KB
MD5

7734f0e56da17e9a5940fd782d739f9b
SHA1

4dfae67e40be6c4c83191ea0cf8d1b28afba884c
SHA256

8855299560183b57556d9714a2b958cdc6190fcdfb270633da2a47dfeee20015
SHA512

53d07938bafbcb9524cdba6d25e09fcdae128a83718ab686374f0526730e2e6380f60e3bf951601e48f6f8e64563c484ddd8baf9be2878a5ad393817028a9632

Score

10^/10

badrabbit bootkit evasion ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Deletes NTFS Change Journal 2 TTPs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
ransomware

Inhibit System Recovery
T1490

Data Destruction
T1485
Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070

Blacklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow	pid	Process
213	1632	rundll32.exe
225	1632	rundll32.exe
374	1632	rundll32.exe
378	1632	rundll32.exe
383	1632	rundll32.exe
390	1632	rundll32.exe

Executes dropped EXE 1 IoCs

Processes:

A9E2.tmp

pid	Process
3444	A9E2.tmp

Modifies WinLogon to allow AutoLogon 2 TTPs 2 IoCs

Enables rebooting of the machine without requiring login credentials.

ransomware bootkit

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

LogonUI.exeLogonUI.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

Drops file in Windows directory 4 IoCs

Processes:

rundll32.exe

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\A9E2.tmp	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
2916	schtasks.exe
1940	schtasks.exe

Modifies data under HKEY_USERS 30 IoCs

Processes:

LogonUI.exeLogonUI.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

rundll32.exeA9E2.tmp

pid	Process
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe
3444	A9E2.tmp
3444	A9E2.tmp
3444	A9E2.tmp
3444	A9E2.tmp
3444	A9E2.tmp
3444	A9E2.tmp
1632	rundll32.exe
1632	rundll32.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

rundll32.exeA9E2.tmpwevtutil.exewevtutil.exewevtutil.exewevtutil.exe

description	pid	Process
Token: SeShutdownPrivilege	1632	rundll32.exe
Token: SeDebugPrivilege	1632	rundll32.exe
Token: SeTcbPrivilege	1632	rundll32.exe
Token: SeDebugPrivilege	3444	A9E2.tmp
Token: SeSecurityPrivilege	3980	wevtutil.exe
Token: SeBackupPrivilege	3980	wevtutil.exe
Token: SeSecurityPrivilege	2560	wevtutil.exe
Token: SeBackupPrivilege	2560	wevtutil.exe
Token: SeSecurityPrivilege	1596	wevtutil.exe
Token: SeBackupPrivilege	1596	wevtutil.exe
Token: SeSecurityPrivilege	188	wevtutil.exe
Token: SeBackupPrivilege	188	wevtutil.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

[email protected]

pid	Process
1036	[email protected]
1036	[email protected]
1036	[email protected]
1036	[email protected]

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

[email protected]

pid	Process
1036	[email protected]
1036	[email protected]
1036	[email protected]
1036	[email protected]

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

LogonUI.exeLogonUI.exe

pid	Process
3920	LogonUI.exe
3920	LogonUI.exe
384	LogonUI.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

rundll32.exerundll32.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 4012 wrote to memory of 1632	4012	rundll32.exe	76
PID 4012 wrote to memory of 1632	4012	rundll32.exe	76
PID 4012 wrote to memory of 1632	4012	rundll32.exe	76
PID 1632 wrote to memory of 4040	1632	rundll32.exe	77
PID 1632 wrote to memory of 4040	1632	rundll32.exe	77
PID 1632 wrote to memory of 4040	1632	rundll32.exe	77
PID 4040 wrote to memory of 3192	4040	cmd.exe	80
PID 4040 wrote to memory of 3192	4040	cmd.exe	80
PID 4040 wrote to memory of 3192	4040	cmd.exe	80
PID 1632 wrote to memory of 3236	1632	rundll32.exe	81
PID 1632 wrote to memory of 3236	1632	rundll32.exe	81
PID 1632 wrote to memory of 3236	1632	rundll32.exe	81
PID 3236 wrote to memory of 1940	3236	cmd.exe	83
PID 3236 wrote to memory of 1940	3236	cmd.exe	83
PID 3236 wrote to memory of 1940	3236	cmd.exe	83
PID 1632 wrote to memory of 3400	1632	rundll32.exe	84
PID 1632 wrote to memory of 3400	1632	rundll32.exe	84
PID 1632 wrote to memory of 3400	1632	rundll32.exe	84
PID 1632 wrote to memory of 3444	1632	rundll32.exe	86
PID 1632 wrote to memory of 3444	1632	rundll32.exe	86
PID 3400 wrote to memory of 2916	3400	cmd.exe	87
PID 3400 wrote to memory of 2916	3400	cmd.exe	87
PID 3400 wrote to memory of 2916	3400	cmd.exe	87
PID 1632 wrote to memory of 3356	1632	rundll32.exe	95
PID 1632 wrote to memory of 3356	1632	rundll32.exe	95
PID 1632 wrote to memory of 3356	1632	rundll32.exe	95
PID 3356 wrote to memory of 3980	3356	cmd.exe	97
PID 3356 wrote to memory of 3980	3356	cmd.exe	97
PID 3356 wrote to memory of 3980	3356	cmd.exe	97
PID 3356 wrote to memory of 2560	3356	cmd.exe	98
PID 3356 wrote to memory of 2560	3356	cmd.exe	98
PID 3356 wrote to memory of 2560	3356	cmd.exe	98
PID 3356 wrote to memory of 1596	3356	cmd.exe	99
PID 3356 wrote to memory of 1596	3356	cmd.exe	99
PID 3356 wrote to memory of 1596	3356	cmd.exe	99
PID 3356 wrote to memory of 188	3356	cmd.exe	100
PID 3356 wrote to memory of 188	3356	cmd.exe	100
PID 3356 wrote to memory of 188	3356	cmd.exe	100
PID 3356 wrote to memory of 512	3356	cmd.exe	101
PID 3356 wrote to memory of 512	3356	cmd.exe	101
PID 3356 wrote to memory of 512	3356	cmd.exe	101
PID 1632 wrote to memory of 1160	1632	rundll32.exe	102
PID 1632 wrote to memory of 1160	1632	rundll32.exe	102
PID 1632 wrote to memory of 1160	1632	rundll32.exe	102
PID 1160 wrote to memory of 1124	1160	cmd.exe	105
PID 1160 wrote to memory of 1124	1160	cmd.exe	105
PID 1160 wrote to memory of 1124	1160	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1036

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Blacklisted process makes network request
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4157025541 && exit"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4157025541 && exit"
      4⤵
      Creates scheduled task(s)
      PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:00
      4⤵
      Creates scheduled task(s)
      PID:2916
- - C:\Windows\A9E2.tmp
    "C:\Windows\A9E2.tmp" \\.\pipe\{2159D35C-E210-4115-A143-21C239820277}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl Setup
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3980
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl System
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2560
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl Security
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1596
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil cl Application
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:188
  - - C:\Windows\SysWOW64\fsutil.exe
      fsutil usn deletejournal /D C:
      4⤵
      PID:512
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN drogon
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN drogon
      4⤵
      PID:1124

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad6055 /state1:0x41c64e6d
1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3920

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad6855 /state1:0x41c64e6d
1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Indicator Removal on Host

T1070

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Destruction

T1485

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\A9E2.tmp

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\A9E2.tmp

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
memory/188-15-0x0000000000000000-mapping.dmp

Download
memory/512-16-0x0000000000000000-mapping.dmp

Download
memory/1124-18-0x0000000000000000-mapping.dmp

Download
memory/1160-17-0x0000000000000000-mapping.dmp

Download
memory/1596-14-0x0000000000000000-mapping.dmp

Download
memory/1632-0-0x0000000000000000-mapping.dmp

Download
memory/1632-1-0x0000000002F80000-0x0000000002FE8000-memory.dmp

Filesize
416KB

Download
memory/1940-5-0x0000000000000000-mapping.dmp

Download
memory/2560-13-0x0000000000000000-mapping.dmp

Download
memory/2916-8-0x0000000000000000-mapping.dmp

Download
memory/3192-3-0x0000000000000000-mapping.dmp

Download
memory/3236-4-0x0000000000000000-mapping.dmp

Download
memory/3356-11-0x0000000000000000-mapping.dmp

Download
memory/3400-6-0x0000000000000000-mapping.dmp

Download
memory/3444-7-0x0000000000000000-mapping.dmp

Download
memory/3980-12-0x0000000000000000-mapping.dmp

Download
memory/4040-2-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads