Bad Rabbit is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. Bad Rabbit has also targeted organizations and consumers in Russia. [1][2][3]
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1548 | .002 | Abuse Elevation Control Mechanism: Bypass User Account Control |
Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.[1] |
Enterprise | T1110 | .003 | Brute Force: Password Spraying |
Bad Rabbit’s |
Enterprise | T1486 | Data Encrypted for Impact |
Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.[1] |
|
Enterprise | T1189 | Drive-by Compromise |
Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a |
|
Enterprise | T1210 | Exploitation of Remote Services |
Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.[1] |
|
Enterprise | T1495 | Firmware Corruption |
Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.[1] |
|
Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
Bad Rabbit has masqueraded as a Flash Player installer through the executable file |
Enterprise | T1106 | Native API |
Bad Rabbit has used various Windows API calls.[2] |
|
Enterprise | T1135 | Network Share Discovery |
Bad Rabbit enumerates open SMB shares on internal victim networks.[2] |
|
Enterprise | T1003 | .001 | OS Credential Dumping: LSASS Memory |
Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.[2] |
Enterprise | T1057 | Process Discovery |
Bad Rabbit can enumerate all running processes to compare hashes.[1] |
|
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
Bad Rabbit’s |
Enterprise | T1218 | .011 | System Binary Proxy Execution: Rundll32 |
Bad Rabbit has used rundll32 to launch a malicious DLL as |
Enterprise | T1569 | .002 | System Services: Service Execution |
Bad Rabbit drops a file named |
Enterprise | T1204 | .002 | User Execution: Malicious File |
Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.[2][1] |
ICS | T0817 | Drive-by Compromise |
Bad Rabbit ransomware spreads through drive-by attacks where insecure websites are compromised. While the target is visiting a legitimate website, a malware dropper is being downloaded from the threat actors infrastructure. [4] |
|
ICS | T0866 | Exploitation of Remote Services |
Bad Rabbit initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks. [5] |
|
ICS | T0867 | Lateral Tool Transfer |
Bad Rabbit can move laterally through industrial networks by means of the SMB service. [5] |
|
ICS | T0828 | Loss of Productivity and Revenue |
Several transportation organizations in Ukraine have suffered from being infected by Bad Rabbit, resulting in some computers becoming encrypted, according to media reports. [6] |
|
ICS | T0863 | User Execution |
Bad Rabbit is disguised as an Adobe Flash installer. When the file is opened it starts locking the infected computer. [4] |
ID | Name | References |
---|---|---|
G0034 | Sandworm Team |