badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/BadRabbit[.]exe

Resubmissions

03/08/2024, 19:41

240803-yeg3paxgpg5

03/08/2024, 18:29

240803-w487cswcqa10

Analysis

max time kernel
45s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03/08/2024, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/BadRabbit.exe
Sample240803-w487cswcqa

Score

10^/10

badrabbit mimikatz defense_evasion discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000200000002a9cb-274.dat	mimikatz

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
5040	BadRabbit.exe
5088	5FEE.tmp
1724	BadRabbit.exe
2960	BadRabbit.exe
2768	BadRabbit.exe

Loads dropped DLL 4 IoCs

pid	Process
3656	rundll32.exe
2784	rundll32.exe
3888	rundll32.exe
3140	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
35	raw.githubusercontent.com

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\5FEE.tmp	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 701428.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 937630.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2332	schtasks.exe
2000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
2096	msedge.exe
2096	msedge.exe
1988	msedge.exe
1988	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
3656	rundll32.exe
3656	rundll32.exe
3656	rundll32.exe
3656	rundll32.exe
5088	5FEE.tmp
5088	5FEE.tmp
5088	5FEE.tmp
5088	5FEE.tmp
5088	5FEE.tmp
5088	5FEE.tmp
5088	5FEE.tmp
2784	rundll32.exe
2784	rundll32.exe
3888	rundll32.exe
3888	rundll32.exe
3140	rundll32.exe
3140	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3656	rundll32.exe
Token: SeDebugPrivilege	3656	rundll32.exe
Token: SeTcbPrivilege	3656	rundll32.exe
Token: SeDebugPrivilege	5088	5FEE.tmp
Token: SeShutdownPrivilege	2784	rundll32.exe
Token: SeDebugPrivilege	2784	rundll32.exe
Token: SeTcbPrivilege	2784	rundll32.exe
Token: SeShutdownPrivilege	3888	rundll32.exe
Token: SeDebugPrivilege	3888	rundll32.exe
Token: SeTcbPrivilege	3888	rundll32.exe
Token: SeShutdownPrivilege	3140	rundll32.exe
Token: SeDebugPrivilege	3140	rundll32.exe
Token: SeTcbPrivilege	3140	rundll32.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5044	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1348	2096	msedge.exe	82
PID 2096 wrote to memory of 1348	2096	msedge.exe	82
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 3380	2096	msedge.exe	83
PID 2096 wrote to memory of 5016	2096	msedge.exe	84
PID 2096 wrote to memory of 5016	2096	msedge.exe	84
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85
PID 2096 wrote to memory of 4032	2096	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/BadRabbit.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9d0963cb8,0x7ff9d0963cc8,0x7ff9d0963cd8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,431981981950257886,3330363160760103072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5040
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:4444
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2956
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1700424826 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4448
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1700424826 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 18:48:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:3560
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 18:48:00
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2000
  - - C:\Windows\5FEE.tmp
      "C:\Windows\5FEE.tmp" \\.\pipe\{A3FC308C-B3BF-4F84-9AF2-AC04DAB9DC92}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5088
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1724
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2960
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4544

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3140

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e73e118-52b7-4212-8591-c413bb47426a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e73e118-52b7-4212-8591-c413bb47426a.tmp
Size 11KB
SHA256 18806fd33b5faa23ccdd2a0ffa28f66713a4ff2e943af3756cd427564f0506d2
MD5 3a7299f9dad8d51ff0ba806ed7f62827
SHA1 6da9ba9e98ff91703109de910eaf1c483946c484
SHA512 04cd32cf11ee139d477ad59a7eb97accd812e15fd73c11269ef3843829c783d49b00d1c0889c2a5e0722c23dc92f6ba82fd69c4702f46fae5c3a7e9101d0874e
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGppje2RUN8RV0MmqMlDtnHiOX:M9iIxuERzA83h09RZxASGp1ommqMJZis
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f
MD5 9af507866fb23dace6259791c377531f
SHA1 5a5914fc48341ac112bfcd71b946fc0b2619f933
SHA512 c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d
MD5 b0177afa818e013394b36a04cb111278
SHA1 dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5
SHA512 d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 431KB
SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
MD5 fbbdc39af1139aebba4da004475e8839
SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 661151b174e5602eb44e42dffca4e41558b01e7d89257ab9a5ab9a543a3d1825
MD5 105845fe878adad938fc4a761b64b824
SHA1 4fe4898bc2120177be7ddf4116297227a689fa7a
SHA512 478a9927568dd2e7a5e1aa99cbff5b0e3e4632f0d7d56fa7bac7f6441f72643a3d307ff5f8fddb558e119d97c53ed97d2f23e444342addda385865388243f3a3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 679d50f28ef89ff76da228b204cc980c6efad30ddcad6217234953392bc84b66
MD5 12023a642d4735a44aca961fcc01eae8
SHA1 fa212178a00ee63f8dabb992210ea91e1ce7ddf3
SHA512 0356ffd90a17c85082c90f80d312ff98f743ff6bf6986c7d85a489a419752a2521fa81457401d3844aac9787eeae2b97e910f5443573e3fe5b55f79e7d08be35
SSDEEP 96:nFk3lfm0kLPwSv0MoiVmdHIAJzu0WQyV+VuziX3wI3:nFk3l+0kLPv0MAI2zuLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 400109ee7c0724affef3aa97986c72c8c6689b33b653953eae162c4bfaa51598
MD5 86d4bcf7a3237d9135d94d842d7b3dde
SHA1 91f5b7359ef7c04627b9376e8ca84d6f928a3cb7
SHA512 2e1adf09dea2553dae965e68bfc561ede68ef4b36d46fe9815b4455bd87a563c43d6b3d3e03e6061c2b8ca6df4569db03e3c5ea9c6b1a593414580d2089df42f
SSDEEP 96:nFk3l8m0kL3wSv0MoiVmdbum1jI4Jzu0WQyV+VpAiX3wI3:nFk3lh0kL3v0MGumhIezuLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 bfa75accdb52178b076879ffe68e827ed1ffb3addfdb7d7d2736b36b98eaa932
MD5 d391bcef5f33c68feffd8844aba53e7d
SHA1 1ccd7c6bc4ae91b4246282b715204ba55623ab73
SHA512 fbf1727c7d8c8b6582ae8fba82a47f990a2c2133ec6a04b433cda7bab1a2a4830f37d0b30ca05bf84d0903d04f392950a69ac11b0bcd32e0f73a6b90a42417cf
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe585232.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585232.TMP
Size 1KB
SHA256 743c573d5ab49e671d64cb72560254929230deca53b9c8b21c0b858303635013
MD5 9e4402ae74ae150eb57fae175be5d3ff
SHA1 2e9da9fad530b423115e2a73ba7e88d213aa3195
SHA512 29c4ed3a00d9446a996423756082e6f098c1e4304a91643f88f62d79233c852c01c8ea6de1e404f3d272ca084f7d15fa2a0821f5f6560dc3415b273b7149f9e9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1dc777cf75cd7eb6feae0f917417d69fb6935974d9d115c0f7bc580ff7a95da5
MD5 648c0d05fa8d03e0ebef84aaae54e017
SHA1 2f0156aefd1a606a8970974f532061e289e8d3b1
SHA512 ecebce8653698c512d18f5a89edbdec116ed51187617ff48307663e9ae622a86e55df8d1a503d5a905854c19f9152d5107c40b8774f329cb434b14d1c29a3e7e
SSDEEP 192:SooCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGppDe2RUN8RV0MjqMlDtnHis:F9iIxuERzA83h09RZxASGpJomjqMJZis
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d86315d03e4587a0ca7278f9ce9b3adb40796152892dffddc923505f9732f7ed
MD5 8a2df9873f86493fa695048792fd21bd
SHA1 4904e622b94920784806910e3bc23c8edaf9ba84
SHA512 919d80a485e154083b21831ea60ca00891580c752f2a5ff4dd7d3da0f2a2f8fff9450d330c66f9b45f4592acd93ae0051abcdfa3c4893f806c94c3db9fc539e8
SSDEEP 192:yoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGppje2RUN8RV0MjqMlDtnHiOX:G9iIxuERzA83h09RZxASGp1omjqMJZis
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 4c6b6384e84e913c1a9438f427a989579712b102ee876ed862d808190f3f31ba
MD5 10b3e6029bd3f6a7aa99e45f20f8a2bc
SHA1 d66b64a66cef494ad245a641819920e8eaa14daf
SHA512 d26980ede9b75952d1348fad852f54fdd5acaa7cb2ccd4a8038c55e1d11bee672bf748f349c06c8ccb5e60cc2c38283c68906b914aeb931c852afc50184db3b0
SSDEEP 192:KJAFJr9oBiV7vi12YJrtkp1NDuSAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1LauJJ:KJWJVq12krtuJ6pmXmlJVjeQ8RJoZwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 fbb114871abc3901711a5f204cb370f1cc1602ad89fa0c8155288ec72e4eaf36
MD5 30f9f69bd4cb3ca8ed4af465e6bf3b72
SHA1 1f7bf3625d683c1af38485d1eb39152949648749
SHA512 ae96746716d0b47912c191ca52db48ee40aca9591444c1f0ffbc913346be1fff1e9f71c6e66cb4c175fd308e04a504367dd56bf84920f94c65142cd8508258c2
SSDEEP 192:rJAFJr9oBiV7vi12YJrtkp1NDuSAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1lauJJ:rJWJVq12krtuJ6pmXmlJVjeQ8RJo3wg
MD5 SHA1 SHA512 SSDEEP

Submit Download

BadRabbit.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
MD5 SHA1 SHA512

Submit Download

5FEE.tmp

Path C:\Windows\5FEE.tmp
Size 60KB
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958
MD5 c4f26ed277b51ef45fa180be597d96e8
SHA1 e9efc622924fb965d4a14bdb6223834d9a9007e7
SHA512 afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
SSDEEP 12288:GtDjvhNTc/cq4RKZZKfArRuSA80m+/6sXRnfPGp:IjTc/cq4RUZaArbInfPGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2784-306-0x00000000030F0000-0x0000000003158000-memory.dmp

Download

memory/2784-314-0x00000000030F0000-0x0000000003158000-memory.dmp

Download

memory/3140-335-0x0000000002E60000-0x0000000002EC8000-memory.dmp

Download

memory/3140-343-0x0000000002E60000-0x0000000002EC8000-memory.dmp

Download

memory/3656-268-0x00000000027B0000-0x0000000002818000-memory.dmp

Download

memory/3656-260-0x00000000027B0000-0x0000000002818000-memory.dmp

Download

memory/3656-253-0x00000000027B0000-0x0000000002818000-memory.dmp

Download

memory/3888-319-0x0000000002310000-0x0000000002378000-memory.dmp

Download

memory/3888-327-0x0000000002310000-0x0000000002378000-memory.dmp

Download