Resubmissions

08-06-2024 08:50

240608-krvyesae91 10

08-05-2024 16:15

240508-tqnx6ach3w 10

08-05-2024 16:07

240508-tkr3mafa54 10

01-05-2024 18:02

240501-wmf49acg3s 6

27-04-2024 08:46

240427-kpfeysff8s 10

25-04-2024 21:25

240425-z9y55afb7v 10

25-04-2024 21:16

240425-z4pphafa97 10

25-04-2024 18:27

240425-w3929sde33 10

25-04-2024 18:17

240425-ww4a5sdc8x 10

Analysis

  • max time kernel
    906s
  • max time network
    909s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-06-2024 08:50

Errors

Reason
Machine shutdown

General

  • Target

    Bad Rabit.exe

  • Size

    431KB

  • MD5

    fbbdc39af1139aebba4da004475e8839

  • SHA1

    de5c8d858e6e41da715dca1c019df0bfb92d32c0

  • SHA256

    630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

  • SHA512

    74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

  • SSDEEP

    12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

  • Deletes NTFS Change Journal 2 TTPs 1 IoCs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Clears Windows event logs 1 TTPs 4 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bad Rabit.exe
    "C:\Users\Admin\AppData\Local\Temp\Bad Rabit.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
            PID:3476
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2231512642 && exit"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4264
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2231512642 && exit"
            4⤵
            • Creates scheduled task(s)
            PID:1816
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:10:00
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:10:00
            4⤵
            • Creates scheduled task(s)
            PID:1036
        • C:\Windows\569C.tmp
          "C:\Windows\569C.tmp" \\.\pipe\{3957EEAA-6831-46C4-BF01-205E2815B051}
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:720
        • C:\Windows\SysWOW64\cmd.exe
          /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:8
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl Setup
            4⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:132
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl System
            4⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:1472
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl Security
            4⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:1936
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl Application
            4⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:1496
          • C:\Windows\SysWOW64\fsutil.exe
            fsutil usn deletejournal /D C:
            4⤵
            • Deletes NTFS Change Journal
            PID:2004
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Delete /F /TN drogon
          3⤵
            PID:2080
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa39ef855 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:3504

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\569C.tmp

        Filesize

        60KB

        MD5

        347ac3b6b791054de3e5720a7144a977

        SHA1

        413eba3973a15c1a6429d9f170f3e8287f98c21c

        SHA256

        301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

        SHA512

        9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

      • C:\Windows\infpub.dat

        Filesize

        401KB

        MD5

        1d724f95c61f1055f0d02c2154bbccd3

        SHA1

        79116fe99f2b421c52ef64097f0f39b815b20907

        SHA256

        579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

        SHA512

        f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

      • memory/3876-4-0x00000000029A0000-0x0000000002A08000-memory.dmp

        Filesize

        416KB

      • memory/3876-11-0x00000000029A0000-0x0000000002A08000-memory.dmp

        Filesize

        416KB

      • memory/3876-14-0x00000000029A0000-0x0000000002A08000-memory.dmp

        Filesize

        416KB