badrabbit | b3c80146802eca48fd4fdd8c7f6e500c360165e4042cfac458d2830e532db4b4

Analysis

max time kernel
396s
max time network
406s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06-08-2024 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BadRabbit.zip
Size

164KB
MD5

c279b056c175248970b86d544d4500ac
SHA1

b23b59b579e95d4c5b5c75f011c6b20438c1e223
SHA256

b3c80146802eca48fd4fdd8c7f6e500c360165e4042cfac458d2830e532db4b4
SHA512

22f25554000b76ad6c8801de02a3cf822210e5675fd117e83220a46fe0b5b56684d0b9d57d1262818c0028319ff7f546d9fa18de6613e5b1fbaac4c746516bdb
SSDEEP

3072:y0xwVWSrh1lhL2rypKP/X6OOKeRw+Ums1YElgGaPYwI1bwecpI7kzBrDUEbhg3P+:fTuoeF3uokeOvHS1d1+sNs8wbiWQu9Lm

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000002a992-498.dat	mimikatz

Executes dropped EXE 2 IoCs

pid	Process
2996	[email protected]
3576	B49D.tmp

Loads dropped DLL 1 IoCs

pid	Process
2968	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
22	raw.githubusercontent.com
63	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\B49D.tmp	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3144	schtasks.exe
1288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
2436	msedge.exe
2436	msedge.exe
4068	msedge.exe
4068	msedge.exe
1692	identity_helper.exe
1692	identity_helper.exe
4392	msedge.exe
4392	msedge.exe
2968	rundll32.exe
2968	rundll32.exe
2968	rundll32.exe
2968	rundll32.exe
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp
3576	B49D.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	3384	7zG.exe
Token: 35	3384	7zG.exe
Token: SeSecurityPrivilege	3384	7zG.exe
Token: SeSecurityPrivilege	3384	7zG.exe
Token: SeRestorePrivilege	4684	7zG.exe
Token: 35	4684	7zG.exe
Token: SeSecurityPrivilege	4684	7zG.exe
Token: SeSecurityPrivilege	4684	7zG.exe
Token: SeShutdownPrivilege	2968	rundll32.exe
Token: SeDebugPrivilege	2968	rundll32.exe
Token: SeTcbPrivilege	2968	rundll32.exe
Token: SeDebugPrivilege	3576	B49D.tmp

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3384	7zG.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
4684	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1948	2436	msedge.exe	89
PID 2436 wrote to memory of 1948	2436	msedge.exe	89
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 1068	2436	msedge.exe	90
PID 2436 wrote to memory of 5064	2436	msedge.exe	91
PID 2436 wrote to memory of 5064	2436	msedge.exe	91
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92
PID 2436 wrote to memory of 868	2436	msedge.exe	92

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\BadRabbit.zip
1⤵
PID:2588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4800

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\BadRabbit\" -spe -an -ai#7zMap15421:98:7zEvent18349
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96e973cb8,0x7ff96e973cc8,0x7ff96e973cd8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,8132130408391156113,16203294176496831537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BadRabbit\" -spe -an -ai#7zMap28432:76:7zEvent18293
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4684

C:\Users\Admin\Desktop\BadRabbit\[email protected]
"C:\Users\Admin\Desktop\BadRabbit\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1572
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:776
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1658356283 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1788
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1658356283 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 11:18:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4736
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 11:18:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1288
- - C:\Windows\B49D.tmp
    "C:\Windows\B49D.tmp" \\.\pipe\{1AE45E73-064E-471E-B0BC-7027C941CC51}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f39003dce228946a52b3b2e5f3e63dda

SHA1
b42c24d40a2020e3d73a6417ef6470db4b3a0a61

SHA256
84938c37c0886106bdd5d0ec2b7e545e492693c766ee7c4a71c23103b0384a3c

SHA512
65fdfd27dc2741eb9190fc2b26ace3a418a351940cad09fe5349b0543eeaaacac618e490aa5dd661c8da4ccfe515f98bdb886e58fd39e4e7d0409c2145b794e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2c582980bcc3e7b7273d2f5f38fdffa0

SHA1
96a265576b0741a4a4e6b579f7ea817f86c87ee6

SHA256
e4eac3d7b2bbab9d825be5827221be8c92447b16470293a7850f69b59ecbcf03

SHA512
19813db9f0c60b6196944eb8ebcff6e61ebd57e56a218b8d683541c911080409650fe0f8a09fa32719ec335fed78ac48732f49b791ee1f072e0163529eed9f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d87c2f5ea6d876e7147f7b345a393170

SHA1
12ecaaba711e8a3fe3a28eaa08dd183294a5bb2f

SHA256
31775f2dfc6d0f6add2b5c4b2a266e45cac11d241d95ea349a0b0e7c7d95d24b

SHA512
580bd6bb860161c5384aca45ddb9d19032355bc1a5c86ad7eff61da6430806d43382ec3690f8b782a457f36a1cd40f9740839cadda51f57aea76b66a3db03abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e287bd0762bb6d1c2ed0cae628b60e92

SHA1
753a5c34c91c8f57aefbe66d5426432f7a8aca8c

SHA256
7170b2bc26d6b2996b23659add345617d99c4ef69c92cfc7a9b8d246ce48cb05

SHA512
ab2218a3281ecf1c6712691f8c289c79c16de2dc812bd4a5916be442df641ca80671a721d928cd0812eba50b99b9f2707f5d4677701589d9d9c0d799e6cf416c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27213dfed07d0b0dda78cd66f879acc3

SHA1
6cab33acee69f42ff09fd645d773675abbc7fa20

SHA256
eefada94816407cbf03ee8fe4852b695790a40af55a19e072a0e848b06a4111c

SHA512
479a6f90260a40b6b47d8775aceb440f0e19ed20f6d52805a7d9a6f75913daf42434ecc041d45e43f8f214aea96e5fa3ee131eb86d77d98a453ed36f2f800f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
abdabd7ffeb4cf100bc80b0e664eea71

SHA1
5bf8f41f54cc0fb5cce02aa141c6c9def95a9a19

SHA256
c5ff9f5124dca8cc41514d0169ce17bd39dd2eb42adc0aba9e1f2fb65618465b

SHA512
77331631dc4aed7e94b10e7a14268da7aa3ccf644fb847e64a9ea2c0a4cb9dd8c698d3b04abd447bf506b8314bd778282cef4bf5310d7465ad5db551f6e83211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c197ec36db1ad361a565160912898a6a

SHA1
94180680e6f80d4e848406eb34eb3d06408ee37c

SHA256
349f74032dfd13d206e4aaaddd7305bab3ffc52e2be71d470d0927f3351e6284

SHA512
74c743c435e75975927ce8d3ac78cc58dab1258542bb613a93407b71b63689deacc341808abb158fd80d2d86b6ac35d6ea5dbf2cb76eaa1318fd0fbe33115859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d3b95.TMP

Filesize
1KB

MD5
6022bc2a4236cdd9f64a100b695ab6c2

SHA1
a0826c111f8b9fd9b809396ca8d2e4fe923b4259

SHA256
7afe9f1e85b9a50fcf34e40e5c2ab45775460d16b7967d0331fd15aaafd30150

SHA512
6fb4436e4fee04a3a8138f908c0b1dcaf24a45d7286bb104e2ae1af068f17f827444fdd97a749672fcefb81bfd975586449a662fec5c18a2751d9ca68d4628eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b5aa8c8fe6e6bda69bff74f7451820f

SHA1
e2d5bcf6a1f684fe3e26086fc58c518f48c6a103

SHA256
4b87b6c0a38b475be426a4e840cecd855afbd30ae3c3c452c8515d8e684d3c22

SHA512
2e34eea2a29d5749b4efb26f1d4938606d4388d614c2943b14c6e6d15e459f22eb2caf1d04c48b9017f337c3ee1305e6d9f1c6546f6ad4a3520d16d5bb5ef687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89ce6b12318d5c337f90b4cdbb6bbcaf

SHA1
d4bf1d08bfd7cc53f230f4f980e1293640b88b13

SHA256
4e95c66197905791d7e2f1e9c8298494c28699775a73c715d3ad70b698b4966f

SHA512
3489b640ed6a020e724b7e228be9fc40051373293529c22f70d2ff48fa4948b4b96d3a9a5735566598372db56c71939d16f2c4ef6394c7c13a358600f959d1d1

Download Submit
C:\Users\Admin\Desktop\BadRabbit\[email protected]

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier

Filesize
226B

MD5
2b8a63f11748759a6c122fe25dceb6af

SHA1
96a26092fe07b3827d0c3efba36cfa5fb69eb1f9

SHA256
e5614cc53eca2ba33c92217a3622c78f9c5fe9084f6e550c4eaddb84edad7ff0

SHA512
345d1b2b7916e5e2bb4455a70fcd20266bbb8261274ad83165deabffeca08ef8975799401ee187a70af33bc4c938294978ef1387b5acec8ae4dbda20ba789b9f

Download Submit
C:\Windows\B49D.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/2968-482-0x0000000001130000-0x0000000001198000-memory.dmp

Filesize
416KB

Download
memory/2968-489-0x0000000001130000-0x0000000001198000-memory.dmp

Filesize
416KB

Download
memory/2968-492-0x0000000001130000-0x0000000001198000-memory.dmp

Filesize
416KB

Download