badrabbit | f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Target

[email protected]
Size

1.9MB
MD5

cb02c0438f3f4ddabce36f8a26b0b961
SHA1

48c4fcb17e93b74030415996c0ec5c57b830ea53
SHA256

64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32
SHA512

373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Score

10^/10

badrabbit ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit

Executes dropped EXE 1 IoCs

pid	Process
3588	81F2.tmp

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\BackupMeasure.tiff	rundll32.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\81F2.tmp	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2068	schtasks.exe
2344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3024	rundll32.exe
3024	rundll32.exe
3024	rundll32.exe
3024	rundll32.exe
3588	81F2.tmp
3588	81F2.tmp
3588	81F2.tmp
3588	81F2.tmp
3588	81F2.tmp
3588	81F2.tmp
3024	rundll32.exe
3024	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3024	rundll32.exe
Token: SeDebugPrivilege	3024	rundll32.exe
Token: SeTcbPrivilege	3024	rundll32.exe
Token: SeDebugPrivilege	3588	81F2.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
860	[email protected]

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
860	[email protected]

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3024	216	rundll32.exe	79
PID 216 wrote to memory of 3024	216	rundll32.exe	79
PID 216 wrote to memory of 3024	216	rundll32.exe	79
PID 3024 wrote to memory of 2336	3024	rundll32.exe	80
PID 3024 wrote to memory of 2336	3024	rundll32.exe	80
PID 3024 wrote to memory of 2336	3024	rundll32.exe	80
PID 2336 wrote to memory of 1332	2336	cmd.exe	82
PID 2336 wrote to memory of 1332	2336	cmd.exe	82
PID 2336 wrote to memory of 1332	2336	cmd.exe	82
PID 3024 wrote to memory of 4024	3024	rundll32.exe	83
PID 3024 wrote to memory of 4024	3024	rundll32.exe	83
PID 3024 wrote to memory of 4024	3024	rundll32.exe	83
PID 3024 wrote to memory of 3612	3024	rundll32.exe	85
PID 3024 wrote to memory of 3612	3024	rundll32.exe	85
PID 3024 wrote to memory of 3612	3024	rundll32.exe	85
PID 3024 wrote to memory of 3588	3024	rundll32.exe	86
PID 3024 wrote to memory of 3588	3024	rundll32.exe	86
PID 4024 wrote to memory of 2068	4024	cmd.exe	89
PID 4024 wrote to memory of 2068	4024	cmd.exe	89
PID 4024 wrote to memory of 2068	4024	cmd.exe	89
PID 3612 wrote to memory of 2344	3612	cmd.exe	90
PID 3612 wrote to memory of 2344	3612	cmd.exe	90
PID 3612 wrote to memory of 2344	3612	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:860

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Modifies extensions of user files
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 613438188 && exit"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 613438188 && exit"
      4⤵
      Creates scheduled task(s)
      PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:01:00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:01:00
      4⤵
      Creates scheduled task(s)
      PID:2344
- - C:\Windows\81F2.tmp
    "C:\Windows\81F2.tmp" \\.\pipe\{B78FEBAB-F370-412B-93A2-E4045033D428}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-9-0x0000000005A20000-0x0000000005A21000-memory.dmp

Filesize
4KB

Download
memory/860-6-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

Filesize
4KB

Download
memory/860-7-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/860-8-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/860-5-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/860-10-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/860-11-0x0000000005A23000-0x0000000005A25000-memory.dmp

Filesize
8KB

Download
memory/860-2-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/860-3-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/3024-13-0x0000000003710000-0x0000000003778000-memory.dmp

Filesize
416KB

Download