badrabbit | 7c34b806afb3ae478c837acdecbc0f5709dad6a17620402b6a7b14d9e2428bbb

General

Target

7c34b806afb3ae478c837acdecbc0f5709dad6a17620402b6a7b14d9e2428bbb.exe
Size

1.5MB
MD5

59058b82e0c8ca6d3801f38036119f5b
SHA1

a0face8c6f0d62327ae1d096b0949b5d0bb140fc
SHA256

7c34b806afb3ae478c837acdecbc0f5709dad6a17620402b6a7b14d9e2428bbb
SHA512

ae295166d938586fe378fa864bf06dd1cc3e521c173610b7dcf05146f47ddf30402224b721aa2aa58b236b8b6bdbfd8789a402360e4216a5b4254804915d2153

Score

10^/10

badrabbit ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit

Executes dropped EXE 1 IoCs

pid	Process
2812	9CDD.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\9CDD.tmp	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2676	schtasks.exe
3260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2288	7c34b806afb3ae478c837acdecbc0f5709dad6a17620402b6a7b14d9e2428bbb.exe
2288	7c34b806afb3ae478c837acdecbc0f5709dad6a17620402b6a7b14d9e2428bbb.exe
1848	rundll32.exe
1848	rundll32.exe
1848	rundll32.exe
1848	rundll32.exe
2812	9CDD.tmp
2812	9CDD.tmp
2812	9CDD.tmp
2812	9CDD.tmp
2812	9CDD.tmp
2812	9CDD.tmp
1848	rundll32.exe
1848	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1848	rundll32.exe
Token: SeDebugPrivilege	1848	rundll32.exe
Token: SeTcbPrivilege	1848	rundll32.exe
Token: SeDebugPrivilege	2812	9CDD.tmp

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1848	1348	rundll32.exe	80
PID 1348 wrote to memory of 1848	1348	rundll32.exe	80
PID 1348 wrote to memory of 1848	1348	rundll32.exe	80
PID 1848 wrote to memory of 1132	1848	rundll32.exe	81
PID 1848 wrote to memory of 1132	1848	rundll32.exe	81
PID 1848 wrote to memory of 1132	1848	rundll32.exe	81
PID 1132 wrote to memory of 1752	1132	cmd.exe	83
PID 1132 wrote to memory of 1752	1132	cmd.exe	83
PID 1132 wrote to memory of 1752	1132	cmd.exe	83
PID 1848 wrote to memory of 1960	1848	rundll32.exe	84
PID 1848 wrote to memory of 1960	1848	rundll32.exe	84
PID 1848 wrote to memory of 1960	1848	rundll32.exe	84
PID 1848 wrote to memory of 2552	1848	rundll32.exe	87
PID 1848 wrote to memory of 2552	1848	rundll32.exe	87
PID 1848 wrote to memory of 2552	1848	rundll32.exe	87
PID 1960 wrote to memory of 2676	1960	cmd.exe	86
PID 1960 wrote to memory of 2676	1960	cmd.exe	86
PID 1960 wrote to memory of 2676	1960	cmd.exe	86
PID 1848 wrote to memory of 2812	1848	rundll32.exe	89
PID 1848 wrote to memory of 2812	1848	rundll32.exe	89
PID 2552 wrote to memory of 3260	2552	cmd.exe	91
PID 2552 wrote to memory of 3260	2552	cmd.exe	91
PID 2552 wrote to memory of 3260	2552	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\7c34b806afb3ae478c837acdecbc0f5709dad6a17620402b6a7b14d9e2428bbb.exe
"C:\Users\Admin\AppData\Local\Temp\7c34b806afb3ae478c837acdecbc0f5709dad6a17620402b6a7b14d9e2428bbb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2288

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2952455122 && exit"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2952455122 && exit"
      4⤵
      Creates scheduled task(s)
      PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:42:00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:42:00
      4⤵
      Creates scheduled task(s)
      PID:3260
- - C:\Windows\9CDD.tmp
    "C:\Windows\9CDD.tmp" \\.\pipe\{6D02A0EB-3B5B-45BC-AF3C-4045A89F0326}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-115-0x0000000000C00000-0x0000000000C68000-memory.dmp

Filesize
416KB

Download
memory/1848-120-0x0000000000C00000-0x0000000000C68000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads