badrabbit | b3c80146802eca48fd4fdd8c7f6e500c360165e4042cfac458d2830e532db4b4

Analysis

max time kernel
396s
max time network
406s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/08/2024, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BadRabbit.zip
Size 164KB
Sample240806-mys4hs1ema
SHA256 b3c80146802eca48fd4fdd8c7f6e500c360165e4042cfac458d2830e532db4b4
MD5 c279b056c175248970b86d544d4500ac
SHA1 b23b59b579e95d4c5b5c75f011c6b20438c1e223
SHA512 22f25554000b76ad6c8801de02a3cf822210e5675fd117e83220a46fe0b5b56684d0b9d57d1262818c0028319ff7f546d9fa18de6613e5b1fbaac4c746516bdb
SSDEEP 3072:y0xwVWSrh1lhL2rypKP/X6OOKeRw+Ums1YElgGaPYwI1bwecpI7kzBrDUEbhg3P+:fTuoeF3uokeOvHS1d1+sNs8wbiWQu9Lm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000002a992-498.dat	mimikatz

Executes dropped EXE 2 IoCs

pid	Process
2996	[email protected]
3576	B49D.tmp

Loads dropped DLL 1 IoCs

pid	Process
2968	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
22	raw.githubusercontent.com
63	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\B49D.tmp	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3144	schtasks.exe
1288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
2436	msedge.exe
2436	msedge.exe
4068	msedge.exe
4068	msedge.exe
1692	identity_helper.exe
1692	identity_helper.exe
4392	msedge.exe
4392	msedge.exe
2968	rundll32.exe
2968	rundll32.exe
2968	rundll32.exe
2968	rundll32.exe
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	3384	7zG.exe
Token: 35	3384	7zG.exe
Token: SeSecurityPrivilege	3384	7zG.exe
Token: SeSecurityPrivilege	3384	7zG.exe
Token: SeRestorePrivilege	4684	7zG.exe
Token: 35	4684	7zG.exe
Token: SeSecurityPrivilege	4684	7zG.exe
Token: SeSecurityPrivilege	4684	7zG.exe
Token: SeShutdownPrivilege	2968	rundll32.exe
Token: SeDebugPrivilege	2968	rundll32.exe
Token: SeTcbPrivilege	2968	rundll32.exe
Token: SeDebugPrivilege	3576	B49D.tmp

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3384	7zG.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
4684	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1948	2436	msedge.exe	89
PID 2436 wrote to memory of 1948	2436	msedge.exe	89
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 5064	2436	msedge.exe	91
PID 2436 wrote to memory of 5064	2436	msedge.exe	91
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\BadRabbit.zip
1⤵
PID:2588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4800

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\BadRabbit\" -spe -an -ai#7zMap15421:98:7zEvent18349
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96e973cb8,0x7ff96e973cc8,0x7ff96e973cd8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BadRabbit\" -spe -an -ai#7zMap28432:76:7zEvent18293
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4684

C:\Users\Admin\Desktop\BadRabbit\[email protected]
"C:\Users\Admin\Desktop\BadRabbit\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1572
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:776
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1658356283 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1658356283 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 11:18:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4736
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 11:18:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1288
- - C:\Windows\B49D.tmp
    "C:\Windows\B49D.tmp" \\.\pipe\{1AE45E73-064E-471E-B0BC-7027C941CC51}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4
MD5 4c3889d3f0d2246f800c495aec7c3f7c
SHA1 dd38e6bf74617bfcf9d6cceff2f746a094114220
SHA512 2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02
MD5 c4a10f6df4922438ca68ada540730100
SHA1 4c7bfbe3e2358a28bf5b024c4be485fa6773629e
SHA512 b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 84938c37c0886106bdd5d0ec2b7e545e492693c766ee7c4a71c23103b0384a3c
MD5 f39003dce228946a52b3b2e5f3e63dda
SHA1 b42c24d40a2020e3d73a6417ef6470db4b3a0a61
SHA512 65fdfd27dc2741eb9190fc2b26ace3a418a351940cad09fe5349b0543eeaaacac618e490aa5dd661c8da4ccfe515f98bdb886e58fd39e4e7d0409c2145b794e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 e4eac3d7b2bbab9d825be5827221be8c92447b16470293a7850f69b59ecbcf03
MD5 2c582980bcc3e7b7273d2f5f38fdffa0
SHA1 96a265576b0741a4a4e6b579f7ea817f86c87ee6
SHA512 19813db9f0c60b6196944eb8ebcff6e61ebd57e56a218b8d683541c911080409650fe0f8a09fa32719ec335fed78ac48732f49b791ee1f072e0163529eed9f52
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 31775f2dfc6d0f6add2b5c4b2a266e45cac11d241d95ea349a0b0e7c7d95d24b
MD5 d87c2f5ea6d876e7147f7b345a393170
SHA1 12ecaaba711e8a3fe3a28eaa08dd183294a5bb2f
SHA512 580bd6bb860161c5384aca45ddb9d19032355bc1a5c86ad7eff61da6430806d43382ec3690f8b782a457f36a1cd40f9740839cadda51f57aea76b66a3db03abd
SSDEEP 96:nRk35fe5ekD/n3swSv0MoiVmdHIvJ+0WQyV+VuziX3wI3:nRk35GkkDvsv0MAIh+LM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7170b2bc26d6b2996b23659add345617d99c4ef69c92cfc7a9b8d246ce48cb05
MD5 e287bd0762bb6d1c2ed0cae628b60e92
SHA1 753a5c34c91c8f57aefbe66d5426432f7a8aca8c
SHA512 ab2218a3281ecf1c6712691f8c289c79c16de2dc812bd4a5916be442df641ca80671a721d928cd0812eba50b99b9f2707f5d4677701589d9d9c0d799e6cf416c
SSDEEP 192:nRk3jkkAvNv0Mc+PuPbKiErF46KQ2In4Le93:nRejkkY0bbirPn4C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 eefada94816407cbf03ee8fe4852b695790a40af55a19e072a0e848b06a4111c
MD5 27213dfed07d0b0dda78cd66f879acc3
SHA1 6cab33acee69f42ff09fd645d773675abbc7fa20
SHA512 479a6f90260a40b6b47d8775aceb440f0e19ed20f6d52805a7d9a6f75913daf42434ecc041d45e43f8f214aea96e5fa3ee131eb86d77d98a453ed36f2f800f5b
SSDEEP 96:nRk35he5ekD/n3swSv0MoiVmdHIvJ+0WQyV+VpAiX3wI3:nRk35ckkDvsv0MAIh+Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c5ff9f5124dca8cc41514d0169ce17bd39dd2eb42adc0aba9e1f2fb65618465b
MD5 abdabd7ffeb4cf100bc80b0e664eea71
SHA1 5bf8f41f54cc0fb5cce02aa141c6c9def95a9a19
SHA512 77331631dc4aed7e94b10e7a14268da7aa3ccf644fb847e64a9ea2c0a4cb9dd8c698d3b04abd447bf506b8314bd778282cef4bf5310d7465ad5db551f6e83211
SSDEEP 192:nRk3tekkQvNv0MgPuPbKiErF46KQ2Im+Le93:nRewkkI0qbirPm+C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 349f74032dfd13d206e4aaaddd7305bab3ffc52e2be71d470d0927f3351e6284
MD5 c197ec36db1ad361a565160912898a6a
SHA1 94180680e6f80d4e848406eb34eb3d06408ee37c
SHA512 74c743c435e75975927ce8d3ac78cc58dab1258542bb613a93407b71b63689deacc341808abb158fd80d2d86b6ac35d6ea5dbf2cb76eaa1318fd0fbe33115859
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5d3b95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d3b95.TMP
Size 1KB
SHA256 7afe9f1e85b9a50fcf34e40e5c2ab45775460d16b7967d0331fd15aaafd30150
MD5 6022bc2a4236cdd9f64a100b695ab6c2
SHA1 a0826c111f8b9fd9b809396ca8d2e4fe923b4259
SHA512 6fb4436e4fee04a3a8138f908c0b1dcaf24a45d7286bb104e2ae1af068f17f827444fdd97a749672fcefb81bfd975586449a662fec5c18a2751d9ca68d4628eb
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4b87b6c0a38b475be426a4e840cecd855afbd30ae3c3c452c8515d8e684d3c22
MD5 2b5aa8c8fe6e6bda69bff74f7451820f
SHA1 e2d5bcf6a1f684fe3e26086fc58c518f48c6a103
SHA512 2e34eea2a29d5749b4efb26f1d4938606d4388d614c2943b14c6e6d15e459f22eb2caf1d04c48b9017f337c3ee1305e6d9f1c6546f6ad4a3520d16d5bb5ef687
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGY3gSe2RUA8o/RnhU6MNTQQHE:M9iIxuERzA83h09RZxASG6VHRIQV0Uo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4e95c66197905791d7e2f1e9c8298494c28699775a73c715d3ad70b698b4966f
MD5 89ce6b12318d5c337f90b4cdbb6bbcaf
SHA1 d4bf1d08bfd7cc53f230f4f980e1293640b88b13
SHA512 3489b640ed6a020e724b7e228be9fc40051373293529c22f70d2ff48fa4948b4b96d3a9a5735566598372db56c71939d16f2c4ef6394c7c13a358600f959d1d1
SSDEEP 192:JoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGY3gSe2RUH80/RnhU6GQQHO0o:19iIxuERzA83h09RZxASG6k3RGQV0Uo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path C:\Users\Admin\Desktop\BadRabbit\[email protected]
Size 431KB
SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
MD5 fbbdc39af1139aebba4da004475e8839
SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
MD5 SHA1 SHA512 SSDEEP

Submit Download

BadRabbit.zip

Path C:\Users\Admin\Downloads\BadRabbit.zip
Size 393KB
SHA256 ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa
MD5 61da9939db42e2c3007ece3f163e2d06
SHA1 4bd7e9098de61adecc1bdbd1a01490994d1905fb
SHA512 14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e
SSDEEP 12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6
MD5 SHA1 SHA512 SSDEEP

Submit Download

BadRabbit.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier
Size 226B
SHA256 e5614cc53eca2ba33c92217a3622c78f9c5fe9084f6e550c4eaddb84edad7ff0
MD5 2b8a63f11748759a6c122fe25dceb6af
SHA1 96a26092fe07b3827d0c3efba36cfa5fb69eb1f9
SHA512 345d1b2b7916e5e2bb4455a70fcd20266bbb8261274ad83165deabffeca08ef8975799401ee187a70af33bc4c938294978ef1387b5acec8ae4dbda20ba789b9f
MD5 SHA1 SHA512

Submit Download

B49D.tmp

Path C:\Windows\B49D.tmp
Size 60KB
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
SSDEEP 12288:GtDjvhNTc/cq4RKZZKfArRuSA80m+/6sXRnfPGp:IjTc/cq4RUZaArbInfPGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2968-482-0x0000000001130000-0x0000000001198000-memory.dmp

Download

memory/2968-489-0x0000000001130000-0x0000000001198000-memory.dmp

Download

memory/2968-492-0x0000000001130000-0x0000000001198000-memory.dmp

Download