badrabbit | hxxp://silaspuma[.]github[.]io/powerpoint

Resubmissions

05-08-2024 13:19

240805-qkssdaxbnp 10

05-08-2024 13:16

240805-qh5zxs1bpc 6

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-08-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://silaspuma.github.io/powerpoint

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000002ab32-753.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
2096	1DB0.tmp

Loads dropped DLL 2 IoCs

pid	Process
2264	rundll32.exe
3412	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
60	raw.githubusercontent.com
104	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\1DB0.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1287768749-810021449-2672985988-1000\{EC4D10DD-1E2C-4636-9D73-BA1EC69A6A91}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3104	schtasks.exe
3480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
1248	msedge.exe
1248	msedge.exe
1048	identity_helper.exe
1048	identity_helper.exe
4152	msedge.exe
4152	msedge.exe
3144	msedge.exe
3144	msedge.exe
4780	msedge.exe
4780	msedge.exe
2264	rundll32.exe
2264	rundll32.exe
2264	rundll32.exe
2264	rundll32.exe
2096	1DB0.tmp
2096	1DB0.tmp
2096	1DB0.tmp
2096	1DB0.tmp
2096	1DB0.tmp
2096	1DB0.tmp
3412	rundll32.exe
3412	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2264	rundll32.exe
Token: SeDebugPrivilege	2264	rundll32.exe
Token: SeTcbPrivilege	2264	rundll32.exe
Token: SeDebugPrivilege	2096	1DB0.tmp
Token: SeShutdownPrivilege	3412	rundll32.exe
Token: SeDebugPrivilege	3412	rundll32.exe
Token: SeTcbPrivilege	3412	rundll32.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3228	1248	msedge.exe	81
PID 1248 wrote to memory of 3228	1248	msedge.exe	81
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 424	1248	msedge.exe	82
PID 1248 wrote to memory of 2312	1248	msedge.exe	83
PID 1248 wrote to memory of 2312	1248	msedge.exe	83
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84
PID 1248 wrote to memory of 4616	1248	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://silaspuma.github.io/powerpoint
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff999eb3cb8,0x7ff999eb3cc8,0x7ff999eb3cd8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8321134927089250683,6636072386897120503,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1208

C:\Users\Admin\Downloads\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:432
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3302788782 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3302788782 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3104
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:39:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:39:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3480
- - C:\Windows\1DB0.tmp
    "C:\Windows\1DB0.tmp" \\.\pipe\{EBE3B855-BFD5-470B-88ED-7DB49A4897A3}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2096

C:\Users\Admin\Downloads\BadRabbit\[email protected]
"C:\Users\Admin\Downloads\BadRabbit\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
23KB

MD5
ce3cc830b1e038999dd41be7ae9e1718

SHA1
ebed20a6d1e3b98b2293a90880d6e9bd5a503bf3

SHA256
5bfb0304c3a1d1128796a32c3da1b1d773dbdebecd7947364553b201300b2445

SHA512
74e649b2ebc3c5443feaa548e5f55e403bf99f27a8c5709e0247e89090c53b0d084903d57ac2e69135325ba7d97f9b7d8284df49fb42b28d53dd51b41bd21578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c660bc2c54f2b83ce6d7ca52b235f7dd

SHA1
200b9af43d87f9632a6d99d030578b7b281dbc54

SHA256
75e9bb64e99a9318da97726111b6237e9a6ecf73a7ed877c5d19943d16a304dc

SHA512
8fe43b97e7f299c66c19f2f5fcdce9e42ad79018254d6a082a99429a8c9acfe1e370b2d3a4a94cf4f0460a0715b728a2ae26d76724733242fd9d0ba1f1dcd684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
b156a94a767b53d9412a0e1df96e2fa3

SHA1
1626e728139a679160a93fc6147bbe71b95fd29d

SHA256
76ca32e3ba7f9b79ca31fc623a953d0b61f82c4e3df2ba04fe924a420344a053

SHA512
eaee32c418214b077ba2bcc8545ec98c5175294a2f675685cfa2d3623b1700a32676336788a688848d54237887298dd70b702c6a97ceaab38be96ba560220fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0242f48f2b694f7ea5ea207856fc4904

SHA1
e63d2749ceb18bd67514b5c2bbe32f0eeb8056cc

SHA256
3c28a5090d82279b0d5da0db2095e2a413c37a6baa981c3bf283b22e0ff9a523

SHA512
c2401d08131ce0d9d43f3dd2ac7f8a4af55792c58095dd8fbf0ae2e3cda88ec267694d6b6ceb3fd6bbb00829a9d6212d36e89e3d36ca9ca99277ee6ae5fdafef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0bfa8955185d01bc84d65664e5e0490c

SHA1
f66f12bc8880592e90558e8e9d406ee5409ce710

SHA256
3a9915e6df298ce454d4c5a1a4c58478bd04a5c7161f7d3f4f7aee3d38e28922

SHA512
3815430794a0770ebf6483313557911a8d95984a215a710009ce92ef4c00e4be42c13ee76f3b1df341c28936db9a24af13cd4065fe332f234a4862fecf9279ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5030f9514d306076bb530897725d8b39

SHA1
491823ed43349dc06acc49204ba06f7931736309

SHA256
8cf116a5e79cb9c27552bfe7c30da1c62121144c55019913f09b5a2f3188bed5

SHA512
10802976ac33d67480f514c155ae9bf5057a131b8ec1c82ff70c8d8a809cb224575dc2449c0d6e645bad16d51e65a4f441854dad9551b029e0ae5f217d72ba91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
723633818a4e24fe0389a4486157f37e

SHA1
66c0f4082100b60eb5ae07a39cdfaf8e89d76ec0

SHA256
83284c12b01ca61bff1cdf65efddcc84e467585a99f5ea793b9b535c8e0d0782

SHA512
ce2e70355c2159b37208fff0ba3e16e0900f63e991df8f6d3c23b223fffcd6119aa4167b61c07bbadb19fbf998b0c7d3db3054ccdbbcc073113b6b5bb9cc5c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fed136c880ef4bfa4f00393a2fa77037

SHA1
3200e91eef50cb191f02ad30400b960f9dcde79e

SHA256
35af4e97f748d500bf20f573c62944154b343f693021b21e4fbe3b8f1aac25c7

SHA512
bea60533e1aae28b8142fc46240dbaa92196ae057f8eaa1ad0621aa53e71c9ce09c3ce9badae648c7bdb1ad57e885c7a94289894ab2de5d8cab26c31084d857e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
45bbfcc8f3ae10daf5d1402f6d31b0fc

SHA1
e506799a460fcb588ee1495c931f198e81fc9028

SHA256
ede99c0d887d6e7f252e3de628b5603ee7165d6d4322495ae23f420a6e2914e0

SHA512
14126e282fed8c0543e27b6ebd498a8604c9f070e79245079d1e38e8e4dd7e5ee2b6b4e54c4dcb2aa39c13b096f78fcfa3b058b3e0b0b0e2395010a544ea05fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
79fcaba5afd555070db060df61e815ac

SHA1
b8a463fcb897147e22f5ec8f8e5a241b327511ca

SHA256
a89cf0ff6bb34be66add4aa93fb8c1803965a9f218725407cd82d826dfa01627

SHA512
fccc9d3803218998c1ddf76968236b81c5a6a6095b276e086fdf44d39648b2cfb30c687f7e67cc040d31513df1a44fabbcf65d9975db9922b6d0a05f8d7948d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
433c9324dc4e6e016474247b5d89f8ef

SHA1
5126831fd5386424cb098d22be3378e5b6641e91

SHA256
6d987b94646e37c7f37aa5187279af2257fb2dd7cc2b4fd9a03a361759eb9c0e

SHA512
e711add2af79d94f2a3f2d0f9db13dd6c3be086549636ec7ea6e4aaf3cf3c5b12b55763072f611d2bb3a93826f53bf7994b38087abb01c94dc782b6b58854454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582045.TMP

Filesize
1KB

MD5
6dab0be78e836dcaaaf129b07ab41020

SHA1
4cedde7b1e5d6e84b75914b3c82fd4d1d2fe9814

SHA256
1b2d4c2c48b2618f61984c950fde116413962470eaa30a49646e383cd657fba2

SHA512
8a5b79ac201679b214434ae21068a3e44622ed058ce01530483ba640f945f88fdc9c1ebf8c3722149e797ce063a8afdedd29cb00aa6e8bf435ec932b65006017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b63b8ab9c8ca9db27ddef756f7b873ea

SHA1
7fb45f00ea3e338d851149228b0073f402689be1

SHA256
1798c14daad574819ce2f6390df4096479c880a422e389f1a3dceb3fb39c6d34

SHA512
ade87684fecfe5d51a350952c174a8b3d57a0b039012d751c3ec2f3854eafbc4e9a8057ac82ba9fc0f116770201fb5520403c1e9814a67fc90dd3df05ff3d625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4cb977396749beb58b728df8ed5a6b35

SHA1
5631cbe3fcb762857d57d3544411fe37499513a2

SHA256
c9398d6da90f1ea17b4538bcff41d6ad5e42abf9b1b223372d6e1adc31678177

SHA512
c91bfa5a9efd50ac736101439dfe602cbfe0a8c88e4c72394cecc9a02bda408dd0bbb3b3cf321c6361b5faf0b4dcac67a7cc99f8aaa9c6695e59731c69de4155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4cebe688737fad5048cda09e5827cbd

SHA1
56f3f8a8e60576ef44e3823cf4b58d9339c460e6

SHA256
f445934852510c3032729a2ad935c76f86919a6a550dcd5df3ade8279ebf9793

SHA512
204f49567474c0d500108a9e11a239d081488157b1deae656658e97861097060e14f93a2cd0a1f44b7b380072dfdfe6ce9666c657ed05e80b922441684f72968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
44fb0c06da3d9c071f7260dfaf242836

SHA1
71f2dde29df9f2bba91324ded2100d1d609cff71

SHA256
8052ed63a5ac0b07b74e685d9c540adc690e6e8a8735d129da68e28e84932a62

SHA512
12ca60f5155d6467f550dbb1dbd6e01fa56739ee1153533d10ca99793435b558f92bb6dbfcf19a5660883d4eec2820c05317f55f32ff0d276450a2e1cd8ad76c

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Windows\1DB0.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/2264-736-0x0000000002C80000-0x0000000002CE8000-memory.dmp

Filesize
416KB

Download
memory/2264-744-0x0000000002C80000-0x0000000002CE8000-memory.dmp

Filesize
416KB

Download
memory/2264-747-0x0000000002C80000-0x0000000002CE8000-memory.dmp

Filesize
416KB

Download
memory/3412-781-0x0000000002240000-0x00000000022A8000-memory.dmp

Filesize
416KB

Download
memory/3412-789-0x0000000002240000-0x00000000022A8000-memory.dmp

Filesize
416KB

Download