Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/E...

windows7-x64

10

Resubmissions

26-05-2023 15:41

230526-s4x8bagf7z 10

26-05-2023 15:37

230526-s2nk4agf6t 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2023 15:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/BadRabbit.zip

Score
10/10
badrabbitmimikatzransomware

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Windows directory 5 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/BadRabbit.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1296
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:596
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
            PID:1344
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1182674467 && exit"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1182674467 && exit"
            4⤵
            • Creates scheduled task(s)
            PID:804
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:56:00
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:56:00
            4⤵
            • Creates scheduled task(s)
            PID:272
        • C:\Windows\F4AC.tmp
          "C:\Windows\F4AC.tmp" \\.\pipe\{A62B0F2B-F550-4B5A-BD6C-57E650A42058}
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1328
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:928
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x2fc
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1724

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\BadRabbit[1].zip
        Filesize

        393KB

        MD5

        61da9939db42e2c3007ece3f163e2d06

        SHA1

        4bd7e9098de61adecc1bdbd1a01490994d1905fb

        SHA256

        ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

        SHA512

        14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab20FA.tmp
        Filesize

        61KB

        MD5

        fc4666cbca561e864e7fdf883a9e6661

        SHA1

        2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

        SHA256

        10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

        SHA512

        c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

        Download Submit

      • C:\Users\Admin\Desktop\BadRabbit.zip.1zhv6z1.partial
        Filesize

        393KB

        MD5

        61da9939db42e2c3007ece3f163e2d06

        SHA1

        4bd7e9098de61adecc1bdbd1a01490994d1905fb

        SHA256

        ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

        SHA512

        14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

        Download Submit

      • C:\Windows\F4AC.tmp
        Filesize

        60KB

        MD5

        347ac3b6b791054de3e5720a7144a977

        SHA1

        413eba3973a15c1a6429d9f170f3e8287f98c21c

        SHA256

        301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

        SHA512

        9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

        Download Submit

      • C:\Windows\infpub.dat
        Filesize

        401KB

        MD5

        1d724f95c61f1055f0d02c2154bbccd3

        SHA1

        79116fe99f2b421c52ef64097f0f39b815b20907

        SHA256

        579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

        SHA512

        f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

        Download Submit

      • memory/596-104-0x0000000001E00000-0x0000000001E68000-memory.dmp

        Filesize

        416KB

        Download

      • memory/596-112-0x0000000001E00000-0x0000000001E68000-memory.dmp

        Filesize

        416KB

        Download

      • memory/596-115-0x0000000001E00000-0x0000000001E68000-memory.dmp

        Filesize

        416KB

        Download

      • memory/1328-139-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/1328-140-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/1328-141-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download