Analysis
-
max time kernel
906s -
max time network
908s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-04-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
BadRabbit.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
BadRabbit.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
BadRabbit.exe
Resource
win11-20240221-en
Errors
General
-
Target
BadRabbit.exe
-
Size
431KB
-
MD5
fbbdc39af1139aebba4da004475e8839
-
SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0
-
SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
-
SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
-
SSDEEP
12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 2656 fsutil.exe -
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Clears Windows event logs 1 TTPs 4 IoCs
pid Process 1544 wevtutil.exe 3392 wevtutil.exe 5116 wevtutil.exe 1860 wevtutil.exe -
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule behavioral3/files/0x000300000002a723-20.dat mimikatz -
Blocklisted process makes network request 5 IoCs
flow pid Process 289 1408 rundll32.exe 375 1408 rundll32.exe 416 1408 rundll32.exe 446 1408 rundll32.exe 475 1408 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 2340 5832.tmp -
Loads dropped DLL 1 IoCs
pid Process 1408 rundll32.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\5832.tmp rundll32.exe File created C:\Windows\infpub.dat BadRabbit.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2584 schtasks.exe 1184 schtasks.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1408 rundll32.exe 1408 rundll32.exe 1408 rundll32.exe 1408 rundll32.exe 2340 5832.tmp 2340 5832.tmp 2340 5832.tmp 2340 5832.tmp 2340 5832.tmp 2340 5832.tmp -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 1408 rundll32.exe Token: SeDebugPrivilege 1408 rundll32.exe Token: SeTcbPrivilege 1408 rundll32.exe Token: SeDebugPrivilege 2340 5832.tmp Token: SeSecurityPrivilege 1544 wevtutil.exe Token: SeBackupPrivilege 1544 wevtutil.exe Token: SeSecurityPrivilege 3392 wevtutil.exe Token: SeBackupPrivilege 3392 wevtutil.exe Token: SeSecurityPrivilege 5116 wevtutil.exe Token: SeBackupPrivilege 5116 wevtutil.exe Token: SeSecurityPrivilege 1860 wevtutil.exe Token: SeBackupPrivilege 1860 wevtutil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 484 LogonUI.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4932 wrote to memory of 1408 4932 BadRabbit.exe 78 PID 4932 wrote to memory of 1408 4932 BadRabbit.exe 78 PID 4932 wrote to memory of 1408 4932 BadRabbit.exe 78 PID 1408 wrote to memory of 2908 1408 rundll32.exe 79 PID 1408 wrote to memory of 2908 1408 rundll32.exe 79 PID 1408 wrote to memory of 2908 1408 rundll32.exe 79 PID 2908 wrote to memory of 4836 2908 cmd.exe 81 PID 2908 wrote to memory of 4836 2908 cmd.exe 81 PID 2908 wrote to memory of 4836 2908 cmd.exe 81 PID 1408 wrote to memory of 1848 1408 rundll32.exe 82 PID 1408 wrote to memory of 1848 1408 rundll32.exe 82 PID 1408 wrote to memory of 1848 1408 rundll32.exe 82 PID 1848 wrote to memory of 2584 1848 cmd.exe 84 PID 1848 wrote to memory of 2584 1848 cmd.exe 84 PID 1848 wrote to memory of 2584 1848 cmd.exe 84 PID 1408 wrote to memory of 4820 1408 rundll32.exe 85 PID 1408 wrote to memory of 4820 1408 rundll32.exe 85 PID 1408 wrote to memory of 4820 1408 rundll32.exe 85 PID 1408 wrote to memory of 2340 1408 rundll32.exe 87 PID 1408 wrote to memory of 2340 1408 rundll32.exe 87 PID 4820 wrote to memory of 1184 4820 cmd.exe 89 PID 4820 wrote to memory of 1184 4820 cmd.exe 89 PID 4820 wrote to memory of 1184 4820 cmd.exe 89 PID 1408 wrote to memory of 2500 1408 rundll32.exe 93 PID 1408 wrote to memory of 2500 1408 rundll32.exe 93 PID 1408 wrote to memory of 2500 1408 rundll32.exe 93 PID 2500 wrote to memory of 1544 2500 cmd.exe 95 PID 2500 wrote to memory of 1544 2500 cmd.exe 95 PID 2500 wrote to memory of 1544 2500 cmd.exe 95 PID 2500 wrote to memory of 3392 2500 cmd.exe 96 PID 2500 wrote to memory of 3392 2500 cmd.exe 96 PID 2500 wrote to memory of 3392 2500 cmd.exe 96 PID 2500 wrote to memory of 5116 2500 cmd.exe 97 PID 2500 wrote to memory of 5116 2500 cmd.exe 97 PID 2500 wrote to memory of 5116 2500 cmd.exe 97 PID 2500 wrote to memory of 1860 2500 cmd.exe 98 PID 2500 wrote to memory of 1860 2500 cmd.exe 98 PID 2500 wrote to memory of 1860 2500 cmd.exe 98 PID 2500 wrote to memory of 2656 2500 cmd.exe 99 PID 2500 wrote to memory of 2656 2500 cmd.exe 99 PID 2500 wrote to memory of 2656 2500 cmd.exe 99 PID 1408 wrote to memory of 3040 1408 rundll32.exe 100 PID 1408 wrote to memory of 3040 1408 rundll32.exe 100 PID 1408 wrote to memory of 3040 1408 rundll32.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\BadRabbit.exe"C:\Users\Admin\AppData\Local\Temp\BadRabbit.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:4836
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4188235203 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4188235203 && exit"4⤵
- Creates scheduled task(s)
PID:2584
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 22:52:003⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 22:52:004⤵
- Creates scheduled task(s)
PID:1184
-
-
-
C:\Windows\5832.tmp"C:\Windows\5832.tmp" \\.\pipe\{66B55A41-B0FA-4F2B-86F3-8F8E85AF0391}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\SysWOW64\cmd.exe/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:3⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Setup4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl System4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Security4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Application4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\fsutil.exefsutil usn deletejournal /D C:4⤵
- Deletes NTFS Change Journal
PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN drogon3⤵PID:3040
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2940
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39e2855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
Filesize
401KB
MD51d724f95c61f1055f0d02c2154bbccd3
SHA179116fe99f2b421c52ef64097f0f39b815b20907
SHA256579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
SHA512f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113