badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

max time kernel
91s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2025, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

badrabbit mimikatz discovery ransomware

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000023e2d-306.dat	mimikatz

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	668	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
2564	BadRabbit.exe
4800	C56E.tmp
4240	BadRabbit.exe

Loads dropped DLL 2 IoCs

pid	Process
1580	rundll32.exe
1272	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
57	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\C56E.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 642425.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3104	schtasks.exe
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
2136	msedge.exe
2136	msedge.exe
4488	identity_helper.exe
4488	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
1580	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe
4800	C56E.tmp
4800	C56E.tmp
4800	C56E.tmp
4800	C56E.tmp
4800	C56E.tmp
4800	C56E.tmp
4800	C56E.tmp
1272	rundll32.exe
1272	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1580	rundll32.exe
Token: SeDebugPrivilege	1580	rundll32.exe
Token: SeTcbPrivilege	1580	rundll32.exe
Token: SeDebugPrivilege	4800	C56E.tmp
Token: SeShutdownPrivilege	1272	rundll32.exe
Token: SeDebugPrivilege	1272	rundll32.exe
Token: SeTcbPrivilege	1272	rundll32.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1992	2136	msedge.exe	85
PID 2136 wrote to memory of 1992	2136	msedge.exe	85
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 3264	2136	msedge.exe	86
PID 2136 wrote to memory of 668	2136	msedge.exe	87
PID 2136 wrote to memory of 668	2136	msedge.exe	87
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88
PID 2136 wrote to memory of 2188	2136	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd95af46f8,0x7ffd95af4708,0x7ffd95af4718
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,16741928293094414482,4686952840917097151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1564

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3570610554 && exit"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1028
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3570610554 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 01:11:00
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1460
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 01:11:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3104
- - C:\Windows\C56E.tmp
    "C:\Windows\C56E.tmp" \\.\pipe\{44532BCB-06AC-4123-ACD6-9411011E4DE1}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56361f50f0ee63ef0ea7c91d0c8b847a

SHA1
35227c31259df7a652efb6486b2251c4ee4b43fc

SHA256
7660beecfee70d695225795558f521c3fb2b01571c224b373d202760b02055c0

SHA512
94582035220d2a78dfea9dd3377bec3f4a1a1c82255b3b74f4e313f56eb2f7b089e36af9fceea9aa83b7c81432622c3c7f900008a1bdb6b1cd12c4073ae4b8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0621e31d12b6e16ab28de3e74462a4ce

SHA1
0af6f056aff6edbbc961676656d8045cbe1be12b

SHA256
1fd3365fdb49f26471ce9e348ce54c9bc7b66230118302b32074029d88fb6030

SHA512
bf0aa5b97023e19013d01abd3387d074cdd5b57f98ec4b0241058b39f9255a7bbab296dce8617f3368601a3d751a6a66dc207d8dd3fc1cba9cac5f98e3127f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3ca57ac52c1b24b5ead1732887a1280a

SHA1
7e0079625dc2e7a40b9474be4b5d406fcce44fd3

SHA256
c072147ac7253c834110c918fa6a04618ec1dae0dbb5ebef67dbcd423df271bd

SHA512
cf3bae3b8248b23f0835296cfaef20956fd7b2ea530812ac33c11d939c34a14e1b79bdb9302f533bc9ce21d4a3ed94120d6af07654eb30318fb69e04b746b081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
7b2253a6fa7b6c941784b92704186809

SHA1
eef99141df17a30e851e15a88373ad50438a1180

SHA256
602fb72bf192a45033d30ad0518344b2f7c173894ff70934259944aab1bf7c88

SHA512
0772930a8d2aaa2f1d2bc65f93de20f65c26145f18ac567f15714a467c203726bade5252a906f40231bda84ce1f663d517a062528de0b0f94df8da358a5892b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17e307212e2fa3f3dcc73574472c4479

SHA1
6aaf77be7616883dab92fec5e558841f4a58f18a

SHA256
7f58f5cb6a2234d6b3413e9b5a04cbd7a81178f75b44e27e259ebfe3005e9d94

SHA512
eef3451daf31eeacce3eb172d3fb571a507b7e7d3524284a1ff80bd6011be024561d862fe0533624b8a1a2f98296254edc2af6b8cdbe13650771cd2083e6e148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b39af4f3276e3d3591016ea70be821ed

SHA1
e213e32604f70a9f3e147456c4e42397851bfeaf

SHA256
743d876ca9173435883b6a310df87e8d9a6e49e2dde7539a6bc8fe9190a651b6

SHA512
6437ac1df0ff807b3fda5d3170e5b6b16cab8a6db596d062f0dfe142b1a460f30b67b929e53a2316020344a4a57f3025223dab1cb0dd1e94fee2c26f843e780d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db172744320d27f5d12935b077a9b7b6

SHA1
c66ea1f14fa4ecc45cbbc6a7f79f9ebb916cc0c4

SHA256
25a92724b3ce95e9113373edb800d268072fe53c49901995e66c2d411420a17c

SHA512
92fcb150df0768270920aab481fb6729d634959fdf15c35542be1d5917c5f9ae0897f94fefb32c37166a4f54baec93361f3c056916a071e3240f8fcd280acc58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e75ea30cc2ffc7f362c5b933a830a270

SHA1
50026609f1fbab9eccbdc924b91d35cd65226481

SHA256
b0b942da0654b5b71dfa9697a57a7a1fcb6d44c87843a06961876af40fca268b

SHA512
f6da2a218adab1503dc5f037586058d70666032fba4ff58907d0bdfdb017af7afb82fa4a7fdebd21328aa13c4e708a492f1690a2838880a18d3e829fedc189e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e6859037369fe1f212f13f4132e204dd

SHA1
694933abb76d506952fa9838353b49f6c79e885c

SHA256
1412b5c622d9d79e93231b201b968a6effb1e04e2950fcb94d051818d2e0ec2f

SHA512
6b43640078831d1410eb8242233d06e37bf5606af1db68221147ae222f165e5bd078bfa5cc2cb7170b3bdc50bfd50b2552fffc3cb5a670bf8fba5e7b954223ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ab76b300715b7015e2fff948dc8b545

SHA1
b42290a9404f72db60c10943278bd484f6c7c24f

SHA256
ef1234f0d1c17ed70ae4608bb3655204eef718d285e498633fb1d2e1781a2b58

SHA512
dc9b3fffb0fae5c7746b12265cc6ea10618faac171f9ee419a244321e2a6977716a6500906f855ee4ffb2d86b87d7eb4cf42873f0cb7c2deeeb4ccf574e0dff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587356.TMP

Filesize
864B

MD5
74b3652da60f9cd0973c5fa9db4bf837

SHA1
52bccdf91abcc8f476743e0d2f7e0c6167675d8e

SHA256
75001ab1fd7327d67b298698a7990bc6a39911c4ff6df9663bfa880693d3045c

SHA512
adddfefff3b6966f5fc09e9438f1dd57ce03370b6379bd1b5c08a363e59475dee8bc9ba4beca19cfd842622a957999cbf3a4faa70a0775cf7f170736b41d0710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
66c4fcd0427bbaa1a50fa6b892b571d3

SHA1
70c99dccd43c203135b11995fc2f3dc84091f123

SHA256
e9c777fe3d64ea8563194da82e2811ea07e312917d37ad8a55f6401b837905ac

SHA512
a4380cedc932dd2102d16c4fdce9a5d74ec814f9082ac1a8a3eb42ae93d8dcc1703b8951e5254adcaad0669aa5c74e858c1a2f9ccf55b3f93be66264bb2634cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d239643666d4ee5dcd9db7ddd3bf0800

SHA1
0f76dd4709261d152197e357274324f9ca974d40

SHA256
d729596375c24bb63ccfd95473ed142b43ae6dfd671336200454ab56b5b45b14

SHA512
f954e70209235718f7e63b9a73054f241afd606ca428ddbc3be11b698d36ecd8a3a06fc3a8c53618b6275f6aacb10a0220903da8467ef06ef67bbacf4ea7ddd6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 642425.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Windows\C56E.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/1272-359-0x0000000002760000-0x00000000027C8000-memory.dmp

Filesize
416KB

Download
memory/1272-367-0x0000000002760000-0x00000000027C8000-memory.dmp

Filesize
416KB

Download
memory/1580-290-0x0000000000FA0000-0x0000000001008000-memory.dmp

Filesize
416KB

Download
memory/1580-298-0x0000000000FA0000-0x0000000001008000-memory.dmp

Filesize
416KB

Download
memory/1580-301-0x0000000000FA0000-0x0000000001008000-memory.dmp

Filesize
416KB

Download