badrabbit | 70b68ac1477e49a4342383c6eff1056f6a18ff0727aa20630e9e7bc8701011f1

Resubmissions

05-08-2024 17:14

240805-vrzlqawfqe 8

05-08-2024 17:12

05-08-2024 17:11

05-08-2024 17:08

05-08-2024 17:04

05-08-2024 17:01

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-08-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample
Size

7KB
MD5

4b320922990cfb723b67147a7a97d345
SHA1

5d134dcee4aaeadbea36761640434a45c708b081
SHA256

70b68ac1477e49a4342383c6eff1056f6a18ff0727aa20630e9e7bc8701011f1
SHA512

b21548566a22c31ca19de100264d1c2cefe0c8d8a0361f325194e6514453813376da301b4bb71c9ac0e4c3c1c84589276af79e7f48dd4e6d8ae553590ac823d3
SSDEEP

96:SDQ1jWHRUV/okJOlIDNSW0S9I3gtYEMLX+jZEBZu:oQHokYlIVYFSjZmu

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000002a9d4-447.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
4372	9F68.tmp

Loads dropped DLL 1 IoCs

pid	Process
2436	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
34	raw.githubusercontent.com
61	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\9F68.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MEMZ.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2628	schtasks.exe
4588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
3744	msedge.exe
3744	msedge.exe
4300	msedge.exe
4300	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
2464	msedge.exe
2464	msedge.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
4372	9F68.tmp
4372	9F68.tmp
4372	9F68.tmp
4372	9F68.tmp
4372	9F68.tmp
4372	9F68.tmp
4372	9F68.tmp
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2436	rundll32.exe
Token: SeDebugPrivilege	2436	rundll32.exe
Token: SeTcbPrivilege	2436	rundll32.exe
Token: SeDebugPrivilege	4372	9F68.tmp

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5116	[email protected]
3144	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1996	8	msedge.exe	87
PID 8 wrote to memory of 1996	8	msedge.exe	87
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3060	8	msedge.exe	88
PID 8 wrote to memory of 3744	8	msedge.exe	89
PID 8 wrote to memory of 3744	8	msedge.exe	89
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90
PID 8 wrote to memory of 2892	8	msedge.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9850f3cb8,0x7ff9850f3cc8,0x7ff9850f3cd8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,1640230006423893094,16695739502625636521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:872
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4020
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2158590815 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2158590815 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:24:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1828
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:24:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4588
- - C:\Windows\9F68.tmp
    "C:\Windows\9F68.tmp" \\.\pipe\{654AEB0F-B630-47BB-8C60-8639E30AC5C8}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4372

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5116
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2adde802918e1bcd080ba57a04f611a4

SHA1
1b9b1c108cb8575ae7173a2c7013a9a64d8e8b59

SHA256
c71157eb9de5fb42555e76a019b67e764e764b8aa1ea5faa90afc7ceee494fe6

SHA512
db1e277869aadfcbb5eede38ec655dc00065b4c4bc6f0023256506964cc6f0b2b2648ee0036ff53592b96da509d95c91615de35e1b4b0a456f79064e219bb0db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0b653b31c71d716903e3b5c61b9a408e

SHA1
483aeb744dac0e544cef1b0d092f8e6a30555f09

SHA256
d82a12dfb9cb66e5bcecb30ebc891537c7cbc1b163f7a56924fb8a0537004499

SHA512
da2ae38ecd65283ca1379044cfa312d7f0e9907afebf0f1107029739ae6e5c9c22239be307d0294534d59956ae310bbff967dae04eaf6e8c5d1eb8388be36908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f0dfc4de467180cdc9c12b3d9d498714

SHA1
250ac973b9a40638b86ef7461feaf1397a57b841

SHA256
2ac771bb06a9472e37ac3437ff2cc56a1fe008330d3b1c30162740ba26a31700

SHA512
8c83624f6375c64f5debf23d3aff3e07a6f92e542cb18a390c2e688b01a4882ac3a88c7953a57e8048f0569056641f1639a073ab9b6a4af320d814171631d7b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5214c4d954184088337e390a44cb91a

SHA1
a1b83a887873a5623434c54516f6c4503f3b2ba8

SHA256
6ef818dcba187a8b8fd419171548c68c1b995287a639fa735d7b9eaabd548e83

SHA512
918e12b77ad67d11dc5bde47aad17178eadf2c3677f40904d6fa4f0816594bb44e85d4b259793d40a7be02d29ad7b45cd8803b366246e6a64b9818f02c71db98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03db31863ce731a4a7b36c1f44b45bc1

SHA1
89a6e1331286eb84a3c2a102ecef2df9b40b2019

SHA256
3ad739989088cad1f04da6290b6f227b3cf7986c30f763be0c93188846aeb004

SHA512
042b69f365859b86551a6635cbaa91ba5cac05f4ca339079a3463e1786e4b448ac0e15dee1c3941dd8636ab4d494cd5ec4f8fd403d860490127bf9530eae5cc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a59c3de3a754e51b647446f87f8c6438

SHA1
276d4b2582a03aae3c1984ce7c661d8843ec8f7d

SHA256
704138267ceff20fe3f6d0c38e994f4a1ec5ca729c8e125c104a77464eeec5da

SHA512
ea270570d027e6c81c9bbd1c59d29fa6848144a491a54496c63069ac5484c0e04b36925d8929352e8bc1bd0c33eef510d8d3fdbb26234b191311d820933c20d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5ff2a8546bdb8adabc91c59c7f9d040

SHA1
a43a1898ac15833101d8616ac4728d7fa0437c6d

SHA256
071667d202703edfab12e5a38669b3e1242faa0f4df3a647ea0978ed19daac1e

SHA512
18b01ce6f0b9c7124d40cbdf9b0e23b60874435c4149ac4dcb65d2f54f5865aaaf794fef622fa7f632c30f24a89c252d668a25a8325482aec8150c9685e9af2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0f629ffca25eec8b4b39e981a781f00b

SHA1
12df979f676df390888bf60790c850f51203a46d

SHA256
0d5ba3a28da8ddfc437471b6ffd0f21219d1979fdf19459b90de290dc7b25396

SHA512
c38d309e61fb5c15962891bc210a6a6f356c2b3ba2167183546b8327d4917bbcf82a53267b83e477f737f6efed114522d14469910a3209b8dcccdbdaab4830c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ee73d23638ecfbae6a8235cb90a5da7

SHA1
2620bb6e8c1dfe74f39d4bb73d587867afd0695d

SHA256
24a91415b3bb8fbba05cb9cdd8ee8f8dd213e8fafdba77e93f617b53c3857122

SHA512
6e3c9f1fb4948be9cf372c718f3c202e31c31e60446c29391185400c62cf276b2bb8ead5892145b865d9a1e25ae06bbc73391cb0453ba7d390aed29075a69dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a97064c61baf466cf7580b800fdcbbd6

SHA1
c60ad69a08c19dde36747a057c3168cd6398f61c

SHA256
274e1214c07a078c721f00e58c08c2c70e694775ddaff1b74be7f4c2626a2117

SHA512
35929cf8699f07236dd13e4455736894f63a57e546866d97aa1a763d860663404a1844c55f6a3aa3bab6539f5fcf4b0d3e55548036ed0d6f8c858d69bd41bfea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7dbecf1b8a8c6dff56e265937a8329a

SHA1
661adb63a5afaf0132c1389e5422b5305e91b70e

SHA256
13bb3d9077a52f62128674b0aeecb53420f9918ceba7c3d1b492b1963b6bb64c

SHA512
acbce41cfc7601f98f4cf7136161050bc70e7c4caacfb44aa8fb5e48394318d99129f34af76b36f6c8adb2b8a0c50da163a744a8dc724eb17b09279aada9b631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18ebd822366f43c0dd886a61fa551608

SHA1
73a56eae5daf8bd6464704fb169561d13dc77d1f

SHA256
419f141a8280fc94cacc88648256a190353ff2c9515f6df08b9233cec8fbaa48

SHA512
caad2b128c9d285bc2c590903119cf9c52c9d5fcc2197cbff84043ee2fe4de241ff95ae68d434a95ec499b3adf803f8c2f54153853544079a73de7f26e38b479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3235ba12c2761952848e5c387c0b064b

SHA1
7451252994da335cefc4b4af82d6cafeede62435

SHA256
a9aa7b776b5b0e0f87f63323fca883c3c5d340107aa72a23422ce9c214e799b0

SHA512
fc9643bb9c38aeba948e246ca4ab376998b52436cc46a912718ddf1d281e0f6fca7c8506b3b8e177eff34559a9f23faa69704f92f1a8f30761691b3884f798d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff5f.TMP

Filesize
1KB

MD5
bec09a27b4340319e03d5592c0c46280

SHA1
b2eb7dc2d8c34ef5b5eb758ec2d343e3ca0eff55

SHA256
4d81e5a322fa059884610948f3f45950ea6dd96b839ae9a537dfd0b18d6f7cd9

SHA512
a0f5529a6191be827e9dddf43846155d0e084a15da01e38227f0fc620aa7d8b36f2be958f2a1cfbe6b0ea42640f0299a8cab0d6b523339cb4cf8f11d7ac26225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edb47b2ce7e32f577df046afae54a056

SHA1
f1ae81985896ec6cd63167cb1fc35066c2261dd1

SHA256
f5e3131810af5ac18215d37c39cc02c04f94d646c4a3991877865446d1324912

SHA512
8b9e2b88950d9524ad7dc7fcaef4d057f0f6f35202a124e86b2090ac5a04df8051205f327ed762602ea05fe1c4a105cbeccce2ba7e7fee63c8ae2ac11b6fbd2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c7f89f9332f3ad84e74848c4fd9188ed

SHA1
b6befad24ce06fde4933133c2070f2e14682250d

SHA256
760f820e2f0696a84d8b27fec2646ab48d4262e3d453019c0c7c8344207f970d

SHA512
8b4195a4dfabc92f8e7085bcd8178536f2217449ed87a77a21350346ab02afbac415ad2f38353a873773a14d046251afd2f541c4aa46a91c73e1fcaa988cf11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e61a65f2850ef470ae149ed753809fb2

SHA1
2c1f25585b70f8d258539b73d08968aa9d4aa79e

SHA256
1f35621561ce27031d772129907aedfdc6a6234ba07c90838cef17b7a9b43de1

SHA512
45aa8d4303c96dc7c00df1c8b589c61348ca818cbb0ecb44f25dc06b958a2a1ee7c3caf2d156cd466a1d87e11c50ac80e30045fcb12f2aeb7d9c02408c22c6dc

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier

Filesize
226B

MD5
2b8a63f11748759a6c122fe25dceb6af

SHA1
96a26092fe07b3827d0c3efba36cfa5fb69eb1f9

SHA256
e5614cc53eca2ba33c92217a3622c78f9c5fe9084f6e550c4eaddb84edad7ff0

SHA512
345d1b2b7916e5e2bb4455a70fcd20266bbb8261274ad83165deabffeca08ef8975799401ee187a70af33bc4c938294978ef1387b5acec8ae4dbda20ba789b9f

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip

Filesize
8KB

MD5
69977a5d1c648976d47b69ea3aa8fcaa

SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a

SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd

Download Submit
C:\Users\Admin\Downloads\MEMZ.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\9F68.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/2436-441-0x0000000002460000-0x00000000024C8000-memory.dmp

Filesize
416KB

Download
memory/2436-411-0x0000000002460000-0x00000000024C8000-memory.dmp

Filesize
416KB

Download
memory/2436-403-0x0000000002460000-0x00000000024C8000-memory.dmp

Filesize
416KB

Download