badrabbit | hxxp://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit[.]zip

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000023536-228.dat	mimikatz

Executes dropped EXE 1 IoCs

Processes:

3D71.tmp

pid	Process
4984	3D71.tmp

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid	Process
636	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
49	raw.githubusercontent.com
50	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

Processes:

[email protected]rundll32.exe

description	ioc	Process
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\3D71.tmp	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeschtasks.exe[email protected]rundll32.execmd.exeschtasks.execmd.exeschtasks.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
4236	schtasks.exe
4004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exerundll32.exe3D71.tmptaskmgr.exe

pid	Process
4420	msedge.exe
4420	msedge.exe
1548	msedge.exe
1548	msedge.exe
3016	identity_helper.exe
3016	identity_helper.exe
3216	msedge.exe
3216	msedge.exe
636	rundll32.exe
636	rundll32.exe
636	rundll32.exe
636	rundll32.exe
4984	3D71.tmp
4984	3D71.tmp
4984	3D71.tmp
4984	3D71.tmp
4984	3D71.tmp
4984	3D71.tmp
4984	3D71.tmp
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

rundll32.exe3D71.tmptaskmgr.exe

description	pid	Process
Token: SeShutdownPrivilege	636	rundll32.exe
Token: SeDebugPrivilege	636	rundll32.exe
Token: SeTcbPrivilege	636	rundll32.exe
Token: SeDebugPrivilege	4984	3D71.tmp
Token: SeDebugPrivilege	2188	taskmgr.exe
Token: SeSystemProfilePrivilege	2188	taskmgr.exe
Token: SeCreateGlobalPrivilege	2188	taskmgr.exe
Token: 33	2188	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2188	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe
2188	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 1548 wrote to memory of 4884	1548	msedge.exe	82
PID 1548 wrote to memory of 4884	1548	msedge.exe	82
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 5036	1548	msedge.exe	83
PID 1548 wrote to memory of 4420	1548	msedge.exe	84
PID 1548 wrote to memory of 4420	1548	msedge.exe	84
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85
PID 1548 wrote to memory of 3204	1548	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/BadRabbit.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb96746f8,0x7ffcb9674708,0x7ffcb9674718
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5692 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2244,8836868396885321225,8912242868213068840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4240

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit.zip\[email protected]"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3907079007 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:100
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3907079007 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4236
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 18:18:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4568
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 18:18:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4004
- - C:\Windows\3D71.tmp
    "C:\Windows\3D71.tmp" \\.\pipe\{35345C8D-6BCA-4095-B5AF-530A1B8892FC}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4984

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
daffba5f5c51edfa798534b85b5102ee

SHA1
78a746be4f3fafbaeca1cb2e911fdcd2edb36250

SHA256
b9fd3e309ab4f499368d30622e258d6bb9001d69b0f4aa1d9f21f2ca6484b075

SHA512
40301619b5dab3f8c2f127e8cab1decb09ee0da9e4d13959c46763e0143c79a6afc2c5ffe2e782ceb1eddbf37c13996ef179efbb36d706bd8b8d9bd7ab4698d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f45234002ab14bc73ce186db980d6430

SHA1
ad4d44dbb405fcc3e1c797a05652ef3e13707333

SHA256
6660405e6fd935c8950db02dd7b8a0b4145a19ecedb98783b7082c7259068cb2

SHA512
44363ec87419636ec21b5de174698746e4784eef52bad8e7eee906f3c6eb9f1464db802b2cf7472f33e8d4d111a13594a468160e74e233df1a5278f22604f338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
d39090d712dae41674a6c4c2e281144d

SHA1
eb315a93b7867b7ce822e763ff950210a920c87e

SHA256
fe431dcd29d088cebeb4398d26fdf8c1edc6d6fa762c183dff3afa16ffec386d

SHA512
cba8945d1e71f4e213a6ebffbb1a1e202428b423ba94d33b3881b0ddb6e1ace8032bb0b09e54d98b86302e77a35347685f401ab164bd91ae003ab6a9c29bb0fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
516d02e8bcd3ab132d933b29bad84e48

SHA1
54aadecf45a381ccbe1dc366272f17a66f8558f3

SHA256
bab4cdf57a5249dafee04d6246661c4c0a9344f96285c8c264593781c33bdc60

SHA512
d26e2675933aff62cd140f210211d78652a17b77e1056fb273769bb1962de0579a303536247d7eb2403feace7c6e49f78cef3f4bc7befd60b0286a2123b8c8e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d03ea08a5f2fef4610147e7ededa7efb

SHA1
80dd9ee333656d1f1c14dae2fc46b955d7f3e69a

SHA256
4359f15ac343ec15201b582f55e1148944dea5976ee47c8861275c9c3202e590

SHA512
833ea6352dced8ad4dd03ed5c7a119e0cdc0e442122bc78706adddceb6a63d66c4d68f61598191fed24db84969be03d3e31d3c5eca3d686015577710d96431e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07aeb80fffd6bfe778fc44da855c306a

SHA1
52d19a3dd80d9a9b85016e11d20c0abc9c565806

SHA256
0490eae771ffa8ea6bca7e5f4a7c7cec4b9f100056e59eff0bd8f1b38eeeca1d

SHA512
d1db616de6256ae7693bccfbe66560b99fe7143aa1b3377a658062f7a7a6441c9d8e43b44aacbd2ad5ee7d9268d8e71aec9018c87bb861ef878275ab883d6a61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db6ecea2a4d1535a846374ec276e9eb7

SHA1
eb0b98f6e1c2c2b0956079d7f1ae09780e894059

SHA256
d587e68b2f6012f6dd909c6329b4555edacbdce067749746ddde76dfc8813132

SHA512
203712f6117826ff98909c5869bc3082b703b153158478d68d8ff126d5c1ef5da065dadaeed674e0875a73ac82396e25b7a503756e45b67e0fbe8ee67acac3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
36d85602c235d15ba5a3615218128339

SHA1
2bbec556b7a72834cf7a344198b8e95681a827d9

SHA256
cfc8bf5b98ecaa37615f5065876702810f633c816725d38a2a25d17d3d74a591

SHA512
fe81fe7fcaa5993c295ea2f2c20ac586557af777f1ff15b91a96ce86ad0e63a6b7a2d178592552b82d91891df706a192cf0c451bcd101068f7f8468e9c17b5d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c039.TMP

Filesize
874B

MD5
e816426c49fd56dc417100668d0774ab

SHA1
8bce6a3f465199c4640c8c5fca6bdf0e187b52bf

SHA256
67d155995d1b194285cb4b6cee7e12ae5a1df2950847351793e7cac206d38056

SHA512
50662c013a97397ab1153a465a9d5a20a0db67c99968b235ec544e4d8bf3e8b5ba8bacb10ae781954888f88907d0304002fd0dc5ac7e9f91d1abc0c5dc76e11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
234f9d7915dbdad20b9f02734fea20f5

SHA1
42edf22da07f6ee3f90d3ae8ea0955b7d899463c

SHA256
4bb6bb2a6ca7dfe665055879e9a37805b9dd57d802dd24fd4eacc52375b755a8

SHA512
dba23eeb1657677836f59746bddce67b791346d44cfc44b8cbd7e33c9171fcb10980c4f7139236ecf5f609a630714ba1d92cf242cc90d94982939d91be95f7f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df21530ad410ab3652ee09ce0e5ea3f2

SHA1
c66583a5709dc3c713de7197d22fead8014515d0

SHA256
c6a6a86867354958f25f9f0d31c4ae1effede94af4e062fd6c84a00ed79f4c40

SHA512
4e76f125855f4982103feda00ca321fd8702153253668029f1de492cd7ac5476107e4e989212ffe9f631b72e713254786661a5b87ed5dbc03a88bd9b7a46b2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1fe4ecbeb4eb31933655a678bad6acbe

SHA1
d37f51c661a337c2384499b40097741deccd8a41

SHA256
37e94dc912306f962ba9e44dca32ae7951eae89f2438a2c3d64ff9679b589082

SHA512
b1c4eb12197c5ce9daf15f463c130202289b5f4d9b504c0432297d5da6646b8bc5258ffa469596fe8a414ef6e635489e128d9d206f6ff036f9c5254ad4d7b495

Download Submit
C:\Users\Admin\Downloads\Activation Security Warning.zip

Filesize
437KB

MD5
22c615e3ede5c9ce4b0e6b157d3cb5a8

SHA1
4ade6563786d60e20d7d9e004cbb669db2f61f96

SHA256
36652fe4c6d926fe6398d49a448b138fc4eca926341bc7feece230dcd540dca5

SHA512
0dfcf308be70663966625a23c5acd8763a0e2644da7d5965aef168764a44c4200d5116af8f27dee0b8da12783f50d3ece95ec29b53e690673d0a1b859e2b8328

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
61da9939db42e2c3007ece3f163e2d06

SHA1
4bd7e9098de61adecc1bdbd1a01490994d1905fb

SHA256
ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

SHA512
14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

Download Submit
C:\Users\Admin\Downloads\BadRabbit.zip

Filesize
393KB

MD5
87088e5c5fcf9cdac06013470aa7b225

SHA1
9f49475b6c71f83a1568f038ac24ae8275e898d8

SHA256
324294a31f85bda45fcbc3bbd2ac92ad0b0e88f39825a6cf9e754ffb2fa7f66b

SHA512
e28aa1e0f66ec6a90655961aa5f47afd50b98d97268cc33839faa56a7c4ec220bddf52c39c74e75d0c917926192116527cffd9407c00088852aaf195d012adc1

Download Submit
C:\Windows\3D71.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
\??\pipe\LOCAL\crashpad_1548_BBGXDGJIJTHKENLA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/636-222-0x0000000002CE0000-0x0000000002D48000-memory.dmp

Filesize
416KB

Download
memory/636-219-0x0000000002CE0000-0x0000000002D48000-memory.dmp

Filesize
416KB

Download
memory/636-211-0x0000000002CE0000-0x0000000002D48000-memory.dmp

Filesize
416KB

Download
memory/2188-268-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-277-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-278-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-279-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-280-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-276-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-275-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-274-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-269-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download
memory/2188-270-0x000001E48F010000-0x000001E48F011000-memory.dmp

Filesize
4KB

Download