badrabbit | f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Target

Endermanch@Antivirus.exe
Size

2.0MB
MD5

c7e9746b1b039b8bd1106bca3038c38f
SHA1

cb93ac887876bafe39c5f9aa64970d5e747fb191
SHA256

b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
SHA512

cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

Score

10^/10

badrabbit persistence ransomware spyware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Executes dropped EXE 1 IoCs

Processes:

F2F7.tmp

pid process

4472 F2F7.tmp
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Users\Admin\Pictures\DisableOut.tiff rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4472	F2F7.tmp

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\DisableOut.tiff	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Endermanch@Antivirus.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	Endermanch@Antivirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan"	Endermanch@Antivirus.exe

Drops file in Program Files directory 2 IoCs

Processes:

Endermanch@Antivirus.exe

description	ioc	process
File created	C:\Program Files (x86)\AnVi\splash.mp3	Endermanch@Antivirus.exe
File created	C:\Program Files (x86)\AnVi\virus.mp3	Endermanch@Antivirus.exe

Drops file in Windows directory 4 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\F2F7.tmp	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4644 schtasks.exe
1696 schtasks.exe

pid	process
4644	schtasks.exe
1696	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Endermanch@Antivirus.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	Endermanch@Antivirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	Endermanch@Antivirus.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2532 IoCs

Processes:

Endermanch@Antivirus.exe

pid	process
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

mofcomp.exerundll32.exeF2F7.tmp

description	pid	process
Token: SeSecurityPrivilege	4316	mofcomp.exe
Token: SeShutdownPrivilege	4052	rundll32.exe
Token: SeDebugPrivilege	4052	rundll32.exe
Token: SeTcbPrivilege	4052	rundll32.exe
Token: SeDebugPrivilege	4472	F2F7.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Endermanch@Antivirus.exe

pid process

4704 Endermanch@Antivirus.exe
4704 Endermanch@Antivirus.exe
4704 Endermanch@Antivirus.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Endermanch@Antivirus.exe

pid process

4704 Endermanch@Antivirus.exe
4704 Endermanch@Antivirus.exe
4704 Endermanch@Antivirus.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

Endermanch@Antivirus.exe

pid	process
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe
4704	Endermanch@Antivirus.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

Endermanch@Antivirus.exenet.exenet.exenet.exenet.exerundll32.exerundll32.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4704 wrote to memory of 3756	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3756	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3756	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3808	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3808	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3808	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3980	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3980	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 3980	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 4024	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 4024	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 4024	4704	Endermanch@Antivirus.exe	net.exe
PID 4704 wrote to memory of 4316	4704	Endermanch@Antivirus.exe	mofcomp.exe
PID 4704 wrote to memory of 4316	4704	Endermanch@Antivirus.exe	mofcomp.exe
PID 4704 wrote to memory of 4316	4704	Endermanch@Antivirus.exe	mofcomp.exe
PID 3808 wrote to memory of 1316	3808	net.exe	net1.exe
PID 3808 wrote to memory of 1316	3808	net.exe	net1.exe
PID 3808 wrote to memory of 1316	3808	net.exe	net1.exe
PID 3756 wrote to memory of 1324	3756	net.exe	net1.exe
PID 3756 wrote to memory of 1324	3756	net.exe	net1.exe
PID 3756 wrote to memory of 1324	3756	net.exe	net1.exe
PID 3980 wrote to memory of 1264	3980	net.exe	net1.exe
PID 3980 wrote to memory of 1264	3980	net.exe	net1.exe
PID 3980 wrote to memory of 1264	3980	net.exe	net1.exe
PID 4024 wrote to memory of 1468	4024	net.exe	net1.exe
PID 4024 wrote to memory of 1468	4024	net.exe	net1.exe
PID 4024 wrote to memory of 1468	4024	net.exe	net1.exe
PID 3996 wrote to memory of 4052	3996	rundll32.exe	rundll32.exe
PID 3996 wrote to memory of 4052	3996	rundll32.exe	rundll32.exe
PID 3996 wrote to memory of 4052	3996	rundll32.exe	rundll32.exe
PID 4052 wrote to memory of 4308	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 4308	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 4308	4052	rundll32.exe	cmd.exe
PID 4308 wrote to memory of 8	4308	cmd.exe	schtasks.exe
PID 4308 wrote to memory of 8	4308	cmd.exe	schtasks.exe
PID 4308 wrote to memory of 8	4308	cmd.exe	schtasks.exe
PID 4052 wrote to memory of 3956	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 3956	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 3956	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 4456	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 4456	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 4456	4052	rundll32.exe	cmd.exe
PID 4052 wrote to memory of 4472	4052	rundll32.exe	F2F7.tmp
PID 4052 wrote to memory of 4472	4052	rundll32.exe	F2F7.tmp
PID 3956 wrote to memory of 1696	3956	cmd.exe	schtasks.exe
PID 3956 wrote to memory of 1696	3956	cmd.exe	schtasks.exe
PID 3956 wrote to memory of 1696	3956	cmd.exe	schtasks.exe
PID 4456 wrote to memory of 4644	4456	cmd.exe	schtasks.exe
PID 4456 wrote to memory of 4644	4456	cmd.exe	schtasks.exe
PID 4456 wrote to memory of 4644	4456	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Endermanch@Antivirus.exe
"C:\Users\Admin\AppData\Local\Temp\Endermanch@Antivirus.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\net.exe
net stop wscsvc
2⤵
- Suspicious use of WriteProcessMemory
PID:3756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc
3⤵
PID:1324

C:\Windows\SysWOW64\net.exe
net stop winmgmt /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
3⤵
PID:1316

C:\Windows\SysWOW64\net.exe
net start winmgmt
2⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt
3⤵
PID:1264

C:\Windows\SysWOW64\net.exe
net start wscsvc
2⤵
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start wscsvc
3⤵
PID:1468

C:\Windows\SysWOW64\Wbem\mofcomp.exe
mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
1⤵
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
2⤵
- Modifies extensions of user files
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Delete /F /TN rhaegal
3⤵
- Suspicious use of WriteProcessMemory
PID:4308

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /F /TN rhaegal
4⤵
PID:8

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2401532936 && exit"
3⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2401532936 && exit"
4⤵
- Creates scheduled task(s)
PID:1696

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:09:00
3⤵
- Suspicious use of WriteProcessMemory
PID:4456

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:09:00
4⤵
- Creates scheduled task(s)
PID:4644

C:\Windows\F2F7.tmp
"C:\Windows\F2F7.tmp" \\.\pipe\{0ED00297-4FBE-4F40-8E15-5F250F4C534B}
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
MD5
7fad92afda308dca8acfc6ff45c80c24

SHA1
a7fa35e7f90f772fc943c2e940737a48b654c295

SHA256
76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f

SHA512
49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

Download Submit
C:\Windows\F2F7.tmp
MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\F2F7.tmp
MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
memory/8-15-0x0000000000000000-mapping.dmp

Download
memory/1264-9-0x0000000000000000-mapping.dmp

Download
memory/1316-7-0x0000000000000000-mapping.dmp

Download
memory/1324-8-0x0000000000000000-mapping.dmp

Download
memory/1468-10-0x0000000000000000-mapping.dmp

Download
memory/1696-19-0x0000000000000000-mapping.dmp

Download
memory/3756-2-0x0000000000000000-mapping.dmp

Download
memory/3808-3-0x0000000000000000-mapping.dmp

Download
memory/3956-16-0x0000000000000000-mapping.dmp

Download
memory/3980-4-0x0000000000000000-mapping.dmp

Download
memory/4024-5-0x0000000000000000-mapping.dmp

Download
memory/4052-12-0x0000000000000000-mapping.dmp

Download
memory/4052-13-0x0000000001240000-0x00000000012A8000-memory.dmp

Filesize
416KB

Download
memory/4308-14-0x0000000000000000-mapping.dmp

Download
memory/4316-6-0x0000000000000000-mapping.dmp

Download
memory/4456-17-0x0000000000000000-mapping.dmp

Download
memory/4472-18-0x0000000000000000-mapping.dmp

Download
memory/4644-22-0x0000000000000000-mapping.dmp

Download