Analysis
-
max time kernel
57s -
max time network
59s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
01-06-2023 09:32
Static task
static1
Behavioral task
behavioral1
Sample
BadRabbit.exe
Resource
win10-20230220-en
windows10-1703-x64
14 signatures
1800 seconds
General
-
Target
BadRabbit.exe
-
Size
431KB
-
MD5
fbbdc39af1139aebba4da004475e8839
-
SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0
-
SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
-
SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
-
SSDEEP
12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
Score
10/10
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows 2 IoCs
resource yara_rule behavioral1/files/0x000600000001ae90-137.dat mimikatz behavioral1/files/0x000600000001ae90-138.dat mimikatz -
Executes dropped EXE 1 IoCs
pid Process 4596 5A0B.tmp -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\5A0B.tmp rundll32.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\infpub.dat BadRabbit.exe File opened for modification C:\Windows\infpub.dat rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4640 schtasks.exe 2280 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18D2F1F7-0070-11EE-8E3B-CE01285E3C5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 4048 rundll32.exe 4048 rundll32.exe 4048 rundll32.exe 4048 rundll32.exe 4596 5A0B.tmp 4596 5A0B.tmp 4596 5A0B.tmp 4596 5A0B.tmp 4596 5A0B.tmp 4596 5A0B.tmp 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeShutdownPrivilege 4048 rundll32.exe Token: SeDebugPrivilege 4048 rundll32.exe Token: SeTcbPrivilege 4048 rundll32.exe Token: SeDebugPrivilege 4596 5A0B.tmp Token: SeDebugPrivilege 3104 taskmgr.exe Token: SeSystemProfilePrivilege 3104 taskmgr.exe Token: SeCreateGlobalPrivilege 3104 taskmgr.exe Token: 33 3104 taskmgr.exe Token: SeIncBasePriorityPrivilege 3104 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 1720 iexplore.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe 3104 taskmgr.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1720 iexplore.exe 1720 iexplore.exe 3632 IEXPLORE.EXE 3632 IEXPLORE.EXE 3632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3096 wrote to memory of 4048 3096 BadRabbit.exe 67 PID 3096 wrote to memory of 4048 3096 BadRabbit.exe 67 PID 3096 wrote to memory of 4048 3096 BadRabbit.exe 67 PID 4048 wrote to memory of 4132 4048 rundll32.exe 68 PID 4048 wrote to memory of 4132 4048 rundll32.exe 68 PID 4048 wrote to memory of 4132 4048 rundll32.exe 68 PID 4132 wrote to memory of 1540 4132 cmd.exe 70 PID 4132 wrote to memory of 1540 4132 cmd.exe 70 PID 4132 wrote to memory of 1540 4132 cmd.exe 70 PID 4048 wrote to memory of 432 4048 rundll32.exe 71 PID 4048 wrote to memory of 432 4048 rundll32.exe 71 PID 4048 wrote to memory of 432 4048 rundll32.exe 71 PID 432 wrote to memory of 4640 432 cmd.exe 73 PID 432 wrote to memory of 4640 432 cmd.exe 73 PID 432 wrote to memory of 4640 432 cmd.exe 73 PID 4048 wrote to memory of 4088 4048 rundll32.exe 74 PID 4048 wrote to memory of 4088 4048 rundll32.exe 74 PID 4048 wrote to memory of 4088 4048 rundll32.exe 74 PID 4048 wrote to memory of 4596 4048 rundll32.exe 76 PID 4048 wrote to memory of 4596 4048 rundll32.exe 76 PID 4088 wrote to memory of 2280 4088 cmd.exe 78 PID 4088 wrote to memory of 2280 4088 cmd.exe 78 PID 4088 wrote to memory of 2280 4088 cmd.exe 78 PID 1720 wrote to memory of 3632 1720 iexplore.exe 83 PID 1720 wrote to memory of 3632 1720 iexplore.exe 83 PID 1720 wrote to memory of 3632 1720 iexplore.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\BadRabbit.exe"C:\Users\Admin\AppData\Local\Temp\BadRabbit.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:1540
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 645314132 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 645314132 && exit"4⤵
- Creates scheduled task(s)
PID:4640
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 11:50:003⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 11:50:004⤵
- Creates scheduled task(s)
PID:2280
-
-
-
C:\Windows\5A0B.tmp"C:\Windows\5A0B.tmp" \\.\pipe\{7235795E-06F1-4E23-959F-0F9842164D49}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3104
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -nohome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3632
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD579db1bc3fde44e15f5c12388c735d7fa
SHA1311daadb80958952b960211d98bc899d59c7e93d
SHA2568c70e8fb5013836a83517c15a4a171c33880ffd89daaab174b23bea9d8f97c9b
SHA512eec41121c6b7db4a822eb395399be74dffd6a7f3746a77d3c7c661a2d0d5680de26b2fd97c0f04b956c98179b4b35cb094ecf42a7fa8d4a4be6e9174da846076
-
Filesize
60KB
MD5347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
Filesize
60KB
MD5347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
Filesize
401KB
MD51d724f95c61f1055f0d02c2154bbccd3
SHA179116fe99f2b421c52ef64097f0f39b815b20907
SHA256579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
SHA512f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113