badrabbit | hxxps://github[.]com/win2007/MalwareDatabase-1/blob/master/BadRabbit%20Ransomware[.]zip

Analysis

max time kernel
133s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-01-2025 21:26

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/win2007/MalwareDatabase-1/blob/master/BadRabbit%20Ransomware.zip

Score

10^/10

badrabbit mimikatz discovery ransomware upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x001b00000002ac0b-234.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
3248	C11.tmp

Loads dropped DLL 1 IoCs

pid	Process
3756	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
13	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 540	2500	CIH.exe	120

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2500-461-0x00000000009B0000-0x00000000009C5000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\C11.tmp	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CIH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BadRabbit Ransomware.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CIH (Win32).zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4692	schtasks.exe
2176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
2760	msedge.exe
2760	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
1460	msedge.exe
1460	msedge.exe
3528	msedge.exe
3528	msedge.exe
3756	rundll32.exe
3756	rundll32.exe
3756	rundll32.exe
3756	rundll32.exe
3248	C11.tmp
3248	C11.tmp
3248	C11.tmp
3248	C11.tmp
3248	C11.tmp
3248	C11.tmp
3248	C11.tmp
1880	msedge.exe
1880	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3756	rundll32.exe
Token: SeDebugPrivilege	3756	rundll32.exe
Token: SeTcbPrivilege	3756	rundll32.exe
Token: SeDebugPrivilege	3248	C11.tmp
Token: SeDebugPrivilege	2500	CIH.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 948	2760	msedge.exe	77
PID 2760 wrote to memory of 948	2760	msedge.exe	77
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 2132	2760	msedge.exe	78
PID 2760 wrote to memory of 1412	2760	msedge.exe	79
PID 2760 wrote to memory of 1412	2760	msedge.exe	79
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80
PID 2760 wrote to memory of 1868	2760	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/win2007/MalwareDatabase-1/blob/master/BadRabbit%20Ransomware.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe5a9e3cb8,0x7ffe5a9e3cc8,0x7ffe5a9e3cd8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,17868358460317262000,12682031727946946305,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit Ransomware.zip\BadRabbit.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_BadRabbit Ransomware.zip\BadRabbit.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3416
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3032609310 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2696
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3032609310 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 21:45:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 21:45:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2176
- - C:\Windows\C11.tmp
    "C:\Windows\C11.tmp" \\.\pipe\{52F933A1-157F-4360-BE89-3BBF590928C0}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3248

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4340

C:\Users\Admin\AppData\Local\Temp\Temp1_CIH (Win32).zip\CIH.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_CIH (Win32).zip\CIH.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2500
- C:\Users\Admin\AppData\Local\Temp\Temp1_CIH (Win32).zip\CIH.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_CIH (Win32).zip\CIH.exe"
  2⤵
  PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\607de1b5-1158-4064-8eea-1ae1fcf3eb29.tmp

Filesize
10KB

MD5
ee98c79db7db01a5b9672f2deee021ea

SHA1
bdafbf3913342c325831884beb9acc5fffe846ab

SHA256
5012fd8318a301ca90f2e29288c4325284a234e2d6638e85efe73275e15f49f0

SHA512
faa0336523ce88628dd10579627a4a16b4bc6f190dcdc6e95f0bd7845607b3ff7335d64248d87614d6b2f450172018b72051e6557bd12bdfe7e37447f4445426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
20KB

MD5
f1d158ece6be315d911c63a682b25376

SHA1
dcebef35fd5e52275d87a2ceada92b81c7654bac

SHA256
d5b683905e1df7cca17a653daf22ec2c5b16534c9e27c09768b1e0c82229aecb

SHA512
0148d7f2f42994de7a3d4be660f0a00d9546f82ffe9e6a597d38b6a1bd1efba8717691a0efe1652c62395f40648b39686d4c7033dfe9c52070b1e1a852509125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b9119c2643d890019b752ccef2cec78f

SHA1
9c7ff366cba8c9ab914e4d02925bf8d659f0eefb

SHA256
ca46cc18a11e93db160a2643672204df5648a6a420f8875475662b68c4aef014

SHA512
67fcfeaef4fd137252bccfabe8f148fe7917901ba26303d16d7a22bce1c93c440cf7198addd0f3269d1456c2bd8c119618ddb2542cffcdf255dd17fa994177b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bf87ab23fe15feb250901eb51a44cf10

SHA1
ac8b6f3faee315247d970a82af697c25cc7a9049

SHA256
ebab764329451d569abc05415b5d4d231a8bc59f93dd5d9fec2f0b4fe9962c11

SHA512
a8a074bab81f5601ec87c1ed091481a0274f339544e6bccf5de4a01f8d3582c97e8641385ce976980b827b3d83fd6ef22014e83b7420020b5f289bd5897c227a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afaf0a095eabd0829e368421e6d1cea3

SHA1
e653104bf1dd759fcf85b42566b08c4a08197516

SHA256
d3b3cff3f177083f0decbfa3ea291edeea3422a1e16abaf3dc1d0848fd5eb401

SHA512
69cbacdef5cd3e5b659030cf0fe0130403724e646963622217650274bc1e6a6a47d6548bed3faf28c72c06a81be8c74c6fced23c0b5a2676514c7e0837eec0eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
430a698fd0ccef5981b6150260f97858

SHA1
f0c3985e7b8009e70fae302eda63b19c752e3f90

SHA256
7afc988b5a0f982a63bec1bef59357c4b68d9b5bc464000f2c81556001a84bbe

SHA512
1c2dc888d154cae95848c44ae87d6d25e311e90f718f6769112433076cc28dee828bdadf6a15e7d6cb35aba098ec87cc4dc8c2935f368eea7e2beea083ff39e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8e081379df6432d0763c0bc20fbbbdd

SHA1
f019e960145c5c5cdc6342837670194cf356d175

SHA256
c55291a690db6ce36c1d310b73d1ccda4fd6d1c3b4db51389e513d3aaf095b22

SHA512
5a471d89b3c20906833c6a549bf5d764eb91e44f5fe99f8831affa2fbe61d39b406be5b98b1adf1f9682d0daf80eaa99904ae354fbbc521fea2c4332cc4a66c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4bda5cc419d0bae14db8d4389d3fb8b8

SHA1
207f4fea120d87bdefefc49780645d5a60de23ca

SHA256
53a54ff2cb4a9b130af648fe5802dc0958f979796e2105d415a9f5cfbc367fb2

SHA512
da1b6a81c69a2b66985ed0b0d10a2406c59a400717872b348b310a78b47d2c7a2f7286304d49aa0f87330d301418e5876181e7a72e60719096e71aea2de757c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2823790e7f6251dbd599539dd2952ff4

SHA1
7dfa05523745776198f6c536c5b9cf007ebeadb2

SHA256
61c8d6626dcbf19f687e6e155844be15b9d53c3c672a3cc457234c5999fe3c3a

SHA512
82cf2979123e23485f4a8307596a253ad01220c0cd0076a8e66c4ead1260b650e9820d61786801fb58d725a09957a303c29b625cb6a597b0e40f2fc9f7b72162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
039bf07535506b56180136194a6522a8

SHA1
1a30866d3e4e26ad20216f151e0da52b913a1640

SHA256
1314c0ceb546af08767ef3646a72621a689a7c493f603efb976df7e7c9363942

SHA512
72ec1af022258840bd970eecdee95868b821b855bbe5c5dcdabf2e1a6404cd6d333b0dda8dddc918b8480084c44131aa9095e6181e11f3b56cc884214dee4617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5df49f8782a8ab3275d8082775aed6d2

SHA1
489f5a003f0f142d11ae86b0e5792ab3ce1e8d35

SHA256
cdb2b39e56112e5a5faf5625d0f1f8e4662fb13539a432d66c2726f18135b4d9

SHA512
53f72fe80a3b37b8f059fef88698bac40952de464fb08f2a4b35fb38a54becbdac897bcdbba55727fc4cc77504973fa14317f8b18316f2ff704dcd1755ad9ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f23f.TMP

Filesize
1KB

MD5
7cdc548a722a9ceb199e5dc0578daa77

SHA1
2f3f59ab2108485b9b0cacc97901019ba09cb6f5

SHA256
12abba57d2f302194781a0f3a94de15298e5525719ce620c81d437094c055844

SHA512
a94cdb6b00cf65a5abc39f434d3b18126a73f69b9dc2c76b8ac2aa1896ccf0658d8fc743da8b7740e9dd3b5b0e8c2e249db63c53280604fc984063ea0f64140e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dbe3bbc50fbe765e2ce23bdc5cba2581

SHA1
bdcb5474c47d2511f5f75943274a65303bed486e

SHA256
74eb4f50d878ad1f0be1932fc8caf4fbc5c53042e808b9da954906c05ad57e5e

SHA512
393e519f9de7f71fee8c9bd948fddb2016c9ff5efc75cfdd41a4abede23d5d72b8cce3b2339b51034ee50be6280eb30674b5a8b4e721f748c462e60cc7d81517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
445d2fc11192b54cd2f81d93ed1b21f9

SHA1
8eb66e5228f5be328c474692314c6daa62df98ff

SHA256
8b1fa5e2bef5a156186caee5ab7c297d863fa6dda22ef4f359237ecf3289e112

SHA512
466b6e31d135455eb2e41e742c672192131760d9f00bdcb9903853e59c7ee1ec33d9b2084d440ea115634348301b26451f665fc80334aac2d6500f73cea83e11

Download Submit
C:\Users\Admin\Downloads\BadRabbit Ransomware.zip

Filesize
395KB

MD5
b303526df291ef092a7650af3d4d63f8

SHA1
97c6532d1df35b3e5c352c29006985468eb7abc5

SHA256
7da4698bb24746aa5349e9e0b3645a7fab8a977308e06c90f5282dbb5ea7d00f

SHA512
603ff899d40df62203cb1d945bb625f10d6eeb439ae5588175fb04c9d850b07517f2b82d2a02f8b8f8a493660cc2a8b592875fcee2376bb6e7fd322398a0ce66

Download Submit
C:\Users\Admin\Downloads\BadRabbit Ransomware.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\CIH (Win32).zip

Filesize
23KB

MD5
859975bdd4fdc8f4af050dc0ded34160

SHA1
d24c5b1c18be9bed4e18d8ad00cc8fe1a6d7d19c

SHA256
445cab9732a748e0d983339d925d9bf8907dd530a300d2d86e86a2df6f1f8749

SHA512
ecda0cc9c62b590cfa91d5c5b814d3d413a8de5ab84db117a6ae7bba0d237f37895f78f6eface71121e9e3691183412060a5369024432202a7cf2e79451864b8

Download Submit
C:\Windows\C11.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/540-462-0x0000000001000000-0x0000000001007000-memory.dmp

Filesize
28KB

Download
memory/2500-461-0x00000000009B0000-0x00000000009C5000-memory.dmp

Filesize
84KB

Download
memory/3756-228-0x0000000002B10000-0x0000000002B78000-memory.dmp

Filesize
416KB

Download
memory/3756-216-0x0000000002B10000-0x0000000002B78000-memory.dmp

Filesize
416KB

Download
memory/3756-208-0x0000000002B10000-0x0000000002B78000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads