Trojan.BadRabbit.3

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'system' = '%TEMP%\gbs1vgat.tw1\Endermanch@Birele.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '%TEMP%\gbs1vgat.tw1\Endermanch@Birele.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%WINDIR%\Web\rundll32.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'AVPCC' = '%WINDIR%\Cursors\avp.exe'
[<HKCU>\software\microsoft\windows\currentversion\run] 'NQIowoIE.exe' = '%HOMEPATH%\TAIQYAIA\NQIowoIE.exe'
[<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\run] 'nMssMsYA.exe' = '%ALLUSERSPROFILE%\aaksokIw\nMssMsYA.exe'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\cscc] 'Start' = '00000000'
[<HKLM>\System\CurrentControlSet\Services\cscc] 'ImagePath' = 'cscc.dat'

Creates the following services

'cscc' cscc.dat

Modifies master boot record (MBR).

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

blocks the following features:

System Restore (SR)

modifies the following system settings:

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyPictures' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMyMusic' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyDocs' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000414'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoToolbarCustomize' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinterTabs' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinters' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoManageMyComputerVerb' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyPictures' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMyMusic' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyDocs' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000414'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoToolbarCustomize' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinterTabs' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinters' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000001'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoManageMyComputerVerb' = '00000001'

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\netsh.exe

Modifies settings of Windows Internet Explorer

[<HKLM>\Software\Wow6432Node\Microsoft\Internet Explorer\Main] 'Window title' = ':::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::'
[<HKCU>\Software\Microsoft\Internet Explorer\Main] 'Window title' = ':::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

<Current directory>\badrabbit.zip
<Current directory>\polyransom.zip
%TEMP%\jcxrwheq.k3o\endermanch@polyransom.exe
%WINDIR%\temp\udd3a8.tmp
%WINDIR%\4ef.tmp
<Current directory>\winlocker.vb6.blacksod.zip
%HOMEPATH%\taiqyaia\nqiowoie
%ALLUSERSPROFILE%\aaksokiw\nmssmsya
%ALLUSERSPROFILE%\aaksokiw\nmssmsya.exe
%TEMP%\36d1130a\ac2e.tmp
%TEMP%\cyoogemy.bat
%TEMP%\jcxrwheq.k3o\endermanch@polyransom
%TEMP%\zoz3sp02.pgy\endermanch@winlockervb6blacksod.exe
%TEMP%\weimwuwc.bat
%ALLUSERSPROFILE%\aaksokiw\nmssmsya.inf
%HOMEPATH%\taiqyaia\nqiowoie.inf
%TEMP%\36d1130a\44f7.tmp
%TEMP%\mojnsbwj.hj0\endermanch@petya.a.exe
%HOMEPATH%\taiqyaia\nqiowoie.exe
<Current directory>\petya.a.zip
%TEMP%\ouawizny.cv0\endermanch@derialock.exe
%TEMP%\ldo5gt42.ge3\endermanch@badrabbit.exe
<Current directory>\birele.zip
%TEMP%\gbs1vgat.tw1\endermanch@birele.exe
%WINDIR%\infpub.dat
<Current directory>\cerber 5.zip
%TEMP%\tbwhs3ec.x11\endermanch@cerber5.exe
<Current directory>\derialock.zip
<Current directory>\fantom.zip
<Current directory>\nomoreransom.zip
%TEMP%\ka0p4tso.b54\fantom.exe
<Current directory>\infinitycrypt.zip
%TEMP%\kf1j41oo.igr\endermanch@infinitycrypt.exe
<Current directory>\krotten.zip
%TEMP%\tosyzryk.ojp\endermanch@krotten.exe
%WINDIR%\cscc.dat
%WINDIR%\dispci.exe
%TEMP%\3qixylrf.nbm\endermanch@nomoreransom.exe
<Current directory>\windows\csrss.exe

Sets the 'hidden' attribute to the following files

%HOMEPATH%\taiqyaia\nqiowoie.exe
%ALLUSERSPROFILE%\aaksokiw\nmssmsya.exe

Deletes the following files

<Current directory>\badrabbit.zip
<Current directory>\birele.zip
<Current directory>\cerber 5.zip
<Current directory>\derialock.zip
<Current directory>\fantom.zip
<Current directory>\infinitycrypt.zip
<Current directory>\krotten.zip
%WINDIR%\infpub.dat
<Current directory>\nomoreransom.zip
<Current directory>\petya.a.zip
<Current directory>\polyransom.zip
%WINDIR%\temp\udd3a8.tmp
%TEMP%\cyoogemy.bat
<Current directory>\winlocker.vb6.blacksod.zip
<Current directory>\windows\csrss.exe
%WINDIR%\4ef.tmp

Network activity

Connects to

'gi##ub.com':443
'ra#.####ubusercontent.com':443
'<LOCALNET>.51.0':445
'<LOCALNET>.51.0':139
'<LOCALNET>.51.1':445
'<LOCALNET>.51.1':139
'<LOCALNET>.51.2':445
'<LOCALNET>.51.2':139
'<LOCALNET>.51.3':445

TCP

Other

'gi##ub.com':443
'ra#.####ubusercontent.com':443

UDP

DNS ASK gi##ub.com
DNS ASK ra#.####ubusercontent.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Program Manager'
ClassName: '' WindowName: 'Г„ГЁГ±ГЇГҐГІГ·ГҐГ° Г§Г Г¤Г Г· Windows'
ClassName: '' WindowName: 'Г‡Г ГЇГіГ±ГЄ ГЇГ°Г®ГЈГ°Г Г¬Г¬Г»'
ClassName: '' WindowName: 'Г‚Г»ГЇГ®Г«ГГЁГІГј'
ClassName: '' WindowName: 'windowssecurity'
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\ldo5gt42.ge3\endermanch@badrabbit.exe'
'%TEMP%\tosyzryk.ojp\endermanch@krotten.exe'
'%ALLUSERSPROFILE%\aaksokiw\nmssmsya.exe'
'%HOMEPATH%\taiqyaia\nqiowoie.exe'
'%WINDIR%\4ef.tmp' \\.\pipe\{E1253F66-538A-4B33-8047-C3AC1239E6F9}
'%TEMP%\mojnsbwj.hj0\endermanch@petya.a.exe'
'%TEMP%\jcxrwheq.k3o\endermanch@polyransom.exe'
'%TEMP%\3qixylrf.nbm\endermanch@nomoreransom.exe'
'%TEMP%\ka0p4tso.b54\fantom.exe'
'%TEMP%\ouawizny.cv0\endermanch@derialock.exe'
'%TEMP%\tbwhs3ec.x11\endermanch@cerber5.exe'
'%TEMP%\gbs1vgat.tw1\endermanch@birele.exe'
'%TEMP%\kf1j41oo.igr\endermanch@infinitycrypt.exe'
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' %WINDIR%\infpub.dat,#1 15
'%WINDIR%\syswow64\cmd.exe' schtasks /Delete /F /TN rhaegal
'%WINDIR%\syswow64\cmd.exe' schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "<SYSTEM32>\cmd.exe /C Start \"\" \"%WINDIR%\dispci.exe\" -id 2530964786 && exit"
'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN rhaegal
'%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state on
'%WINDIR%\syswow64\cmd.exe' schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "<SYSTEM32>\shutdown.exe /r /t 0 /f" /ST 00:26:00
'%WINDIR%\syswow64\netsh.exe' advfirewall reset
'%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\jcxrwheq.k3o\Endermanch@PolyRansom"
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'%WINDIR%\syswow64\schtasks.exe' /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "<SYSTEM32>\cmd.exe /C Start \"\" \"%WINDIR%\dispci.exe\" -id 2530964786 && exit"
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\WEIMwUwc.bat" "%TEMP%\jcxrwheq.k3o\Endermanch@PolyRansom.exe""
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'%WINDIR%\syswow64\schtasks.exe' /Create /SC once /TN drogon /RU SYSTEM /TR "<SYSTEM32>\shutdown.exe /r /t 0 /f" /ST 00:26:00

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial