Analysis

  • max time kernel
    177s
  • max time network
    178s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2024 07:12

General

  • Target

    BadRabbit.zip

  • Size

    393KB

  • MD5

    61da9939db42e2c3007ece3f163e2d06

  • SHA1

    4bd7e9098de61adecc1bdbd1a01490994d1905fb

  • SHA256

    ea8ccb8b5ec36195af831001b3cc46caedfc61a6194e2568901e7685c57ceefa

  • SHA512

    14d0bc14a10e5bd8022e7ab4a80f98600f84754c2c80e22a8e3d9f9555dde5bad056d925576b29fc1a37e73c6ebca693687b47317a469a7dfdc4ab0f3d97a63e

  • SSDEEP

    12288:KPd6ZnyRPZJhKymLkH+yDXZEyfMrvDca6:Koy5ZJ7BeeXmb8a6

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BadRabbit.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2252
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:376
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2308
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1355648636 && exit"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:340
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1355648636 && exit"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1828
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 07:32:00
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 07:32:00
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2744
      • C:\Windows\25D8.tmp
        "C:\Windows\25D8.tmp" \\.\pipe\{72655514-63B1-4D09-9F1D-B9FE754F094C}
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2384
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2236
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2508
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1060
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\RegisterConvert.7z
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\RegisterConvert.7z
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:864
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\RegisterConvert.7z"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2112
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1820
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2372
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    c0dba47d378768fa7530ce242c928321

    SHA1

    31e12170028fdd669f598193bcbb6bb86d600099

    SHA256

    fdc3f2e730955b89692cbd2d9b1707d5d4e8ad8f36e785355b3bffbcc763dc7d

    SHA512

    86ac007f021a2e1c90bb4cb0cf3a86deb791030c77813b1a956363bfc86bd87622ed6f7c5d1d649ba45dc8cd28ca278328d7488249cbb883242ac76747688baf

  • C:\Users\Admin\Desktop\[email protected]

    Filesize

    431KB

    MD5

    fbbdc39af1139aebba4da004475e8839

    SHA1

    de5c8d858e6e41da715dca1c019df0bfb92d32c0

    SHA256

    630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

    SHA512

    74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

  • C:\Windows\25D8.tmp

    Filesize

    60KB

    MD5

    347ac3b6b791054de3e5720a7144a977

    SHA1

    413eba3973a15c1a6429d9f170f3e8287f98c21c

    SHA256

    301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

    SHA512

    9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

  • C:\Windows\infpub.dat

    Filesize

    401KB

    MD5

    c29d6253d89ee9c0c872dd377a7a8454

    SHA1

    46be3800684f6b208e0a8c7b120ef8614c22c4b0

    SHA256

    03f4198a279ea4c36a62cd271d3b2d796547013548666006fbef45e20bb920cb

    SHA512

    50141de5e0a827688251161353932b677c85e0d6e6831293c9a0044543e541fe8bd4e62fa403abc06df9d220fd843aa58ff9cc37abf46be3e06ae14905c24a5e

  • C:\Windows\infpub.dat

    Filesize

    401KB

    MD5

    c4f26ed277b51ef45fa180be597d96e8

    SHA1

    e9efc622924fb965d4a14bdb6223834d9a9007e7

    SHA256

    14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

    SHA512

    afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

  • C:\Windows\infpub.dat

    Filesize

    401KB

    MD5

    1d724f95c61f1055f0d02c2154bbccd3

    SHA1

    79116fe99f2b421c52ef64097f0f39b815b20907

    SHA256

    579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

    SHA512

    f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

  • memory/376-15-0x0000000000270000-0x00000000002D8000-memory.dmp

    Filesize

    416KB

  • memory/376-7-0x0000000000270000-0x00000000002D8000-memory.dmp

    Filesize

    416KB

  • memory/376-18-0x0000000000270000-0x00000000002D8000-memory.dmp

    Filesize

    416KB

  • memory/1060-78-0x0000000000250000-0x00000000002B8000-memory.dmp

    Filesize

    416KB

  • memory/1060-70-0x0000000000250000-0x00000000002B8000-memory.dmp

    Filesize

    416KB

  • memory/1820-106-0x00000000009F0000-0x0000000000A58000-memory.dmp

    Filesize

    416KB

  • memory/1820-114-0x00000000009F0000-0x0000000000A58000-memory.dmp

    Filesize

    416KB

  • memory/2236-40-0x0000000000210000-0x0000000000278000-memory.dmp

    Filesize

    416KB

  • memory/2236-32-0x0000000000210000-0x0000000000278000-memory.dmp

    Filesize

    416KB

  • memory/2508-66-0x0000000000970000-0x00000000009D8000-memory.dmp

    Filesize

    416KB

  • memory/2508-58-0x0000000000970000-0x00000000009D8000-memory.dmp

    Filesize

    416KB

  • memory/2736-118-0x0000000000270000-0x00000000002D8000-memory.dmp

    Filesize

    416KB

  • memory/2736-126-0x0000000000270000-0x00000000002D8000-memory.dmp

    Filesize

    416KB