badrabbit | hxxps://github[.]com/Endermanch/MalwareDatabase

max time kernel
107s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000233f8-388.dat	mimikatz

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	[email protected]

Executes dropped EXE 1 IoCs

pid	Process
5748	F1E.tmp

Loads dropped DLL 1 IoCs

pid	Process
5212	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
71	raw.githubusercontent.com
72	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\F1E.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5872	schtasks.exe
5884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
3176	msedge.exe
3176	msedge.exe
4212	identity_helper.exe
4212	identity_helper.exe
3832	msedge.exe
3832	msedge.exe
5212	rundll32.exe
5212	rundll32.exe
5212	rundll32.exe
5212	rundll32.exe
5748	F1E.tmp
5748	F1E.tmp
5748	F1E.tmp
5748	F1E.tmp
5748	F1E.tmp
5748	F1E.tmp
5748	F1E.tmp
5396	msedge.exe
5396	msedge.exe
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]
3944	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5212	rundll32.exe
Token: SeDebugPrivilege	5212	rundll32.exe
Token: SeTcbPrivilege	5212	rundll32.exe
Token: SeDebugPrivilege	5748	F1E.tmp
Token: SeDebugPrivilege	3944	[email protected]

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3408	3176	msedge.exe	84
PID 3176 wrote to memory of 3408	3176	msedge.exe	84
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 2676	3176	msedge.exe	85
PID 3176 wrote to memory of 5024	3176	msedge.exe	86
PID 3176 wrote to memory of 5024	3176	msedge.exe	86
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87
PID 3176 wrote to memory of 4512	3176	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9991f46f8,0x7ff9991f4708,0x7ff9991f4718
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,6423106082511858781,3836449956307417166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3424

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3364
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5308
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:5356
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 894419108 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5676
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 894419108 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5872
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 21:16:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5712
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 21:16:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5884
- - C:\Windows\F1E.tmp
    "C:\Windows\F1E.tmp" \\.\pipe\{A19D9D61-3094-444C-9063-067F296D850C}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5748

C:\Users\Admin\AppData\Local\Temp\Temp1_DeriaLock.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_DeriaLock.zip\[email protected]"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f3d6269754b7ab0072717733f608ecd3

SHA1
0f25475fc694425c7d16deff065fe5ce3bc6c99a

SHA256
9eacd4ec62917ae9982132ac0709b4c37e4523c91ecdf2e922277e7f8643a73d

SHA512
b8e5321361a8719a2aa0708a4a2f7bba2fc35485bd22a2a5eb046fc2e0c0ec25e17a9adebc713bab1f8209d1d0684c5a7ff2c1dfe5670b8a92e26398c94b9a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9dab438cbf38f1ade71a4db11d00c16

SHA1
08b07f8758e20b6b6a36590d2287c34c559e330a

SHA256
aea3f5d739f0e779d25d0961f252de89480b906b96a823e7f6cb00f00ffd59d6

SHA512
c375cde0f1d78f1a05c65de5bba9ad8fb16657eb7952ce394e964f2d9eb139450b70a05bde9a718898df06ae05b26810a0e02a7eeb2fd062dc1d730c98690013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d522f4ce66d3be6be772ae534374f327

SHA1
f978baebfb92cf94be829c6cc94754a0ef176bd1

SHA256
c9871f473085900acc3dd489758b3b78aeefddebcb60e74637e130eca5022dbb

SHA512
9f2b595a5a054bdc2929ec1da8592ebdb3c034f2f46b37db984798bb474c531d73f650bd73e01b5eae43771ab2c42c5ed95da434ef644a72f365cb32a57f5a45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e44d8d96f1be29ed9f394140da1ee3d3

SHA1
2e6abc9572c5f1afc6ebbf3c24bb489428f5ab0a

SHA256
01d66864a1f4080caa553f72707c6451fa61f6ab1cf0674e15ec9170faaf6866

SHA512
68805e25f3e9342b702006ad42ac7ddfd78fd6490f728a89d0db9bc461a1ab32b1e314b82c4889878c429b8cb24ed23d7f9c7d8f5f2c03d7a0d8e0f8073986ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e666a1bb7ad574e80d2ffb0bf122103d

SHA1
8e033a20bfac042f1c4b20e277b4438d8b93376d

SHA256
d73da2c3536b11572e125d21c37621629cd6f6482b48d017d0a00252b9df1365

SHA512
252e3af7b86f26a67564e4473306c86b70d948919f4fa807db8442f420e6b5e4d2c560862fb966e7e11ad34b4073f5e61df2a513c7270c0964284d26cda35c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0333d661d1768f839be36a171669c5a

SHA1
37457039d48bc5780d5895f9fe8429e96f001661

SHA256
559b88bbad8350e6594523e7f174e4505a43e2425ebc39f1524dc8decd2eac24

SHA512
552b1d6bf8af7df6668f75097f1e298495b78e090afbb24a8e00ea64541205b3a0f870625ef82863e7844a82b542777846c01eec282d0b8652a79577d383a244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e6b6.TMP

Filesize
1KB

MD5
c5b5029d8bdfa0ebcf1e9678b409e9a3

SHA1
4addfa1c8a553063d49ae0890c48262c4cce35f6

SHA256
8600f05bbdec453b9ecb34da6e7a3bd508ec6c883ac22c5442755b6149bf08d1

SHA512
3fbcd058cc4a9a7b78db2d05dd53e5cb0a0504deef01fdda32f5cd9a33e1775c6846147a9da7024cceca145fd4587c9198102be7a46e4a74a3655669828bbff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
76348b329b86569963ef587361a74b29

SHA1
e893e295627963cf2b8d6a940c8973e9e8d81ae3

SHA256
c529c430540b1df7085e4ede02bd4fa6d1e738ca698a9719dbaa1305bec851d0

SHA512
aa360fa7a1627c0df1778b2519d9cb78d42618209215144ec2480c1a480971422bdcd586ba2692dd57d92c4434ed42ab83b483cff952ca06740248c6f6e11f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
79a27f19e14412c64efb28aa046baad1

SHA1
ec6f223924283fff9a7445b9950ec5524f03d1f6

SHA256
c974e5156598bad4ceb8c4ea6d7c4fe5e03c74278e56010a431ced555eeaebd8

SHA512
9db314653b5c184f59c7aa3d1da68cfc1d9a6666f0db2515a751bc5006625a17970ed889b06e8d84b52d6bdf06a6608af46c6cb1cd5c69ea12232c3822620439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f640a7a4-7ec0-403a-bef2-ff7bdf33b04d.tmp

Filesize
12KB

MD5
5235cf48976fc5561bc96a6a9ad9793a

SHA1
eab223f7f8e19ef421049ae04f66a8006ae98127

SHA256
7ce2cc8169c8de0144285bf6ed4cfd5d3950062b9e1b6b70535679bd21cdb10f

SHA512
bd827b824a9acfe96455de1f64ed059b67bb1e333aa2e72d546dd4c0c728b297181ba66df8665eae96e5e531576601da40dadcd83669e04bec03766ca2b6908f

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
b63e80d60a5b47df59280f8caed7b4ee

SHA1
c8085844cc461badbd3738cca9f6a79aefc1931c

SHA256
2a19aa031f1d633ad51eb675a47f04767f0d20f8f5477e2cce22814fc6b279c3

SHA512
ed3872086bbc856a31398c65d43eeabc58c69cf7485548e5c447b5f477f4f0ab78b88de081dc6472e62f55b4101db0fb6360094d181b862cbc74e0c5902eec5c

Download Submit
C:\Users\Admin\Downloads\DeriaLock.zip

Filesize
210KB

MD5
016d1ca76d387ec75a64c6eb3dac9dd9

SHA1
b0a2b2d4d639c6bcc5b114b3fcbb56d7c7ddbcbe

SHA256
8037a333dfeca754a46e284b8c4b250127daef6d728834bf39497df03006e177

SHA512
f08653184d7caf48e971635699b17b9502addb33fb91cc6e0a563e6a000aeb57ac0a2edd5a9e21ef99a4770c0dbb65899150fa5842b0326976a299382f6be86e

Download Submit
C:\Windows\F1E.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/3944-473-0x0000000000B80000-0x0000000000C02000-memory.dmp

Filesize
520KB

Download
memory/3944-483-0x00000000055A0000-0x000000000563C000-memory.dmp

Filesize
624KB

Download
memory/3944-484-0x0000000005CA0000-0x0000000006244000-memory.dmp

Filesize
5.6MB

Download
memory/3944-485-0x00000000056F0000-0x0000000005782000-memory.dmp

Filesize
584KB

Download
memory/3944-491-0x0000000005650000-0x000000000565A000-memory.dmp

Filesize
40KB

Download
memory/3944-492-0x00000000058E0000-0x0000000005936000-memory.dmp

Filesize
344KB

Download
memory/5212-356-0x0000000002020000-0x0000000002088000-memory.dmp

Filesize
416KB

Download
memory/5212-348-0x0000000002020000-0x0000000002088000-memory.dmp

Filesize
416KB

Download
memory/5212-382-0x0000000002020000-0x0000000002088000-memory.dmp

Filesize
416KB

Download