Overview

overview

10

Static

static

URLScan

urlscan

https://github.com/a...

windows7_x64

10

Analysis

  • max time kernel
    350s
  • max time network
    351s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    13-11-2021 17:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/acastillorobles77/MalwareDatabase/raw/master/BadRabbit%20Ransomware.zip

Score
10/10
badrabbitmimikatzransomware

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops file in Windows directory 13 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/acastillorobles77/MalwareDatabase/raw/master/BadRabbit%20Ransomware.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1168
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BadRabbit Ransomware\" -spe -an -ai#7zMap22360:102:7zEvent6437
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1820
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x528
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:892
  • C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe
    "C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Modifies extensions of user files
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
            PID:1052
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4126421655 && exit"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1552
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4126421655 && exit"
            4⤵
            • Creates scheduled task(s)
            PID:996
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:34:00
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1756
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:34:00
            4⤵
            • Creates scheduled task(s)
            PID:1776
        • C:\Windows\425D.tmp
          "C:\Windows\425D.tmp" \\.\pipe\{15A5AF7A-C280-4A93-98E3-AEF598BFA237}
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1424
    • C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe
      "C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
    • C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe
      "C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
    • C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe
      "C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:516
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1796
    • C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe
      "C:\Users\Admin\Downloads\BadRabbit Ransomware\BadRabbit.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1068
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      1⤵
        PID:1268
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1152
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1532
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:865296 /prefetch:2
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:992
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\ImportHide.pdf"
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:272
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\BackupDisconnect.css
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:996
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\ReceiveOpen.ps1"
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:1724
      • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\Desktop\RestoreGrant.ppt"
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1768
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          2⤵
            PID:836

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/768-56-0x0000000003D80000-0x0000000003D81000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1012-70-0x0000000000210000-0x0000000000278000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1012-65-0x0000000000210000-0x0000000000278000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1020-87-0x0000000000920000-0x0000000000988000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1020-92-0x0000000000920000-0x0000000000988000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1064-125-0x0000000000120000-0x0000000000188000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1064-120-0x0000000000120000-0x0000000000188000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1768-135-0x0000000070E51000-0x0000000070E53000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1768-140-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1768-136-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1768-134-0x0000000074521000-0x0000000074525000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1796-109-0x0000000000A60000-0x0000000000AC8000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1796-114-0x0000000000A60000-0x0000000000AC8000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1820-58-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1972-98-0x0000000000890000-0x00000000008F8000-memory.dmp

          Filesize

          416KB

          Download

        • memory/1972-103-0x0000000000890000-0x00000000008F8000-memory.dmp

          Filesize

          416KB

          Download

        • memory/2032-60-0x0000000075A01000-0x0000000075A03000-memory.dmp

          Filesize

          8KB

          Download