hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit[.]zip

Resubmissions

04-08-2024 09:02

240804-kzf48s1glm 8

04-08-2024 08:57

240804-kw28aswbpc 10

03-08-2024 19:52

240803-ylf4zatcrq 3

Analysis

max time kernel
40s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2024 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 3244	3324	msedge.exe	82
PID 3324 wrote to memory of 3244	3324	msedge.exe	82
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 388	3324	msedge.exe	83
PID 3324 wrote to memory of 3572	3324	msedge.exe	84
PID 3324 wrote to memory of 3572	3324	msedge.exe	84
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85
PID 3324 wrote to memory of 4748	3324	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dff46f8,0x7ffe8dff4708,0x7ffe8dff4718
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4460250778935901381,12736362152319061043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4460250778935901381,12736362152319061043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4460250778935901381,12736362152319061043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4460250778935901381,12736362152319061043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4460250778935901381,12736362152319061043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\019ca4e6-f7cb-404f-a4f2-231ce2a52ae3.tmp

Filesize
6KB

MD5
6a62b430cb326d9cd10443592c5f871e

SHA1
408c58213d6b4572956f472c41e8036fbab254b1

SHA256
77aa7cbbe6d1fda8209328e1c22cbd1dd34cdf8eb8f9c703d1489b122c857db3

SHA512
5573fe35e328456859421764fd1f619821fc84c34c031b0d2d7fb3ec4b4cfe6247dfc17f6b5de66b4a7f73c339dcacc0d36caa57d36703295adb5b015c240be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
76940f5f9f10683810fdec47974f769b

SHA1
86083033474b35af2d83df0eee47c8c73a6d6d3e

SHA256
4a66862c12dd99d6895667455317d46aacf64151ab643ae4c2ad15d934dc110f

SHA512
f91235e44ea147ff07bbb4f89fa4bf8c5f6d574cc3399326eac2b5c49b5c6ab5edd582dc1175d657b2ebd54531bba9a9cf3dfe563f55503efe1ce52316e2d756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18d45f977e180cd8f2d866e10b83410b

SHA1
47b0432ce762e127379e8c9c8fbc287898254749

SHA256
d65ca2d90681b1f8de49c2a3344efefdfd606070fc331f0524fb7b3b7518f73a

SHA512
ed3d7de2efb55ebcaeb2b42e76c0820e3b48eab502416aedb76347bccc3ecc4ef430161f980b5a4672c07da58161bbff376e815bd97c25b99aed6748ab8647e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c6285e65ded216b382d4f7526857c2f

SHA1
8601bbd2ad9c39c45df57e2bdabcdb6552af53c1

SHA256
3f1ae798712090d5eb143f3556d0e06495b7b76fd33cc23a25e7fae72e919206

SHA512
9c47223fb2eb2d5f58f752e2c1f4b4e17f4d9460151abf9b8b08b5a09f75e83908aa6f4b3f2ffdf8c2506638fae42fececbf12d364b045b66375d7acb2400087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
26fca98f34aeada5db06e4f332fe8fdd

SHA1
8582bd28f008fb6341b51a922d9eafbb68d61daa

SHA256
650fa91cd923fe647bfb4e2f5ae225365550a4f7e27f6a3b9e1e025eaa0340fa

SHA512
c230adc9c6ed493fcf157512f5409741ad12fec9f35c5dc475ef9ebeeca6f036f5553671e04fc6afc67e3b9dce1c7936d8910f539d27266843d25b6d97d01376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
047ead832d5cb1ba1e37895d2c0aef2a

SHA1
1c58d988b5a0b0499e99b9cdfe151d0d2964698e

SHA256
05bddd63db2683fbce5d4356146e1a6175d7d01c2647da589c40776379004fda

SHA512
291a07395f4c5e82813dbb4dde6449d497b3aafa9baf25b7e96dbf9b242ad8e60a4cb72460da26ed7b013ab7328a62718128410c1847d38cece9adb0e2ea0612

Download Submit