File name:

BadRabbit.exe

Full analysis: https://app.any.run/tasks/e8c3ff66-eddd-4f44-aaa2-55ae8cf17e6c
Verdict: Malicious activity
Analysis date: April 29, 2025, 17:20:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

FBBDC39AF1139AEBBA4DA004475E8839

SHA1:

DE5C8D858E6E41DA715DCA1C019DF0BFB92D32C0

SHA256:

630325CAC09AC3FAB908F903E3B00D0DADD5FDAA0875ED8496FCBB97A558D0DA

SSDEEP:

12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • BadRabbit.exe (PID: 4180)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 6452)
      • cmd.exe (PID: 6732)
      • cmd.exe (PID: 5300)
      • cmd.exe (PID: 6808)
      • cmd.exe (PID: 1348)

  • SUSPICIOUS

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 4428)
      • schtasks.exe (PID: 4436)
      • schtasks.exe (PID: 4452)
      • schtasks.exe (PID: 6588)
      • schtasks.exe (PID: 6940)
      • schtasks.exe (PID: 5972)
      • schtasks.exe (PID: 668)
      • schtasks.exe (PID: 6960)
      • schtasks.exe (PID: 1220)
      • schtasks.exe (PID: 1828)
      • schtasks.exe (PID: 968)

    • The process executes via Task Scheduler

      • cmd.exe (PID: 1680)
      • PLUGScheduler.exe (PID: 4376)

    • Starts CMD.EXE for commands execution

      • dispci.exe (PID: 3932)
      • dispci.exe (PID: 2188)
      • dispci.exe (PID: 7104)
      • dispci.exe (PID: 7112)

    • The system shut down or reboot

      • cmd.exe (PID: 5272)

  • INFO

    • Manual execution by a user

      • dispci.exe (PID: 6844)
      • dispci.exe (PID: 6864)
      • dispci.exe (PID: 7104)
      • dispci.exe (PID: 7112)
      • mspaint.exe (PID: 4076)
      • dispci.exe (PID: 6648)
      • dispci.exe (PID: 2188)
      • mspaint.exe (PID: 6776)
      • mspaint.exe (PID: 5140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:10:22 02:33:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 12288
InitializedDataSize: 43520
UninitializedDataSize: -
EntryPoint: 0x12c0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line
FileVersionNumber: 27.0.0.170
ProductVersionNumber: 27.0.0.170
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Adobe Systems Incorporated
FileDescription: Adobe® Flash® Player Installer/Uninstaller 27.0 r0
FileVersion: 27,0,0,170
InternalName: Adobe® Flash® Player Installer/Uninstaller 27.0
LegalCopyright: Copyright © 1996-2017 Adobe Systems Incorporated
LegalTrademarks: Adobe® Flash® Player
OriginalFileName: FlashUtil.exe
ProductName: Adobe® Flash® Player Installer/Uninstaller
ProductVersion: 27,0,0,170
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
346
Monitored processes
76
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
cmd.exe no specs conhost.exe no specs dispci.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs plugscheduler.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs dispci.exe no specs conhost.exe no specs dispci.exe no specs schtasks.exe no specs schtasks.exe no specs dispci.exe dispci.exe conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs mspaint.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs dispci.exe no specs dispci.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs mspaint.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs mspaint.exe no specs cmd.exe no specs conhost.exe no specs shutdown.exe no specs mspaint.exe no specs ai.exe no specs winword.exe badrabbit.exe no specs mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\namessurvey.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668schtasks /Delete /F /TN rhaegalC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
856"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "86774FD8-C33E-4E49-AB2A-F2DE8A61999E" "347F88AA-315E-425C-87AA-E30B2EE075CB" "1324"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcrt.dll
872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
964\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
968schtasks /Delete /F /TN rhaegalC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
992/c schtasks /Delete /F /TN viserion_5C:\Windows\SysWOW64\cmd.exe—dispci.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1220schtasks /Delete /F /TN viserion_5C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
Total events
11 627
Read events
11 383
Write events
217
Delete events
27

Modification events

(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\1324
Operation:writeName:0
Value:
0B0E1067736901C98A2C4DA1566564F986F6EE230046EEFBF1F6AFA5EEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511AC0AD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(1324) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
1
Suspicious files
47
Text files
1
Unknown types
18

Dropped files

PID
Process
Filename
Type
1324WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\App1745947225454628000_01697367-8AC9-4D2C-A156-6564F986F6EE.log —
MD5:—
SHA256:—
1324WINWORD.EXEC:\Users\admin\Desktop\~$uefrom.rtfbinary
MD5:6E9D5F7625C4BF1DC5A2F5EDD05542C5
SHA256:6B671D6780897BBC1AFAFF5DB9754DB5BA69A0B6D0C2BEABC348A50D8DDF71D0
1324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:89081F50528F0B9F3AD0BF3F2A562C08
SHA256:B52549F2A11FE51A01E6B68CF41A63302D1E1830DEC60D635C1E7F1AAC44914B
1324WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\truefrom.rtf.LNKbinary
MD5:1AF356B2115B365B78D738393FF191A8
SHA256:7DEC7A4DDD6C898C92DA95ECC182D90E34A41B2CB48DFA117C4AE9A8B1E7CD66
3932dispci.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
1324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-shmbinary
MD5:491F27491D480E142A59DE3249C391E5
SHA256:7628F8368D64699D36C7C82B997F8BF4D0AEF447FCADAACA4DB42D4EAEA8B806
1324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.jsonbinary
MD5:6CA4960355E4951C72AA5F6364E459D5
SHA256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
1324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.jsonbinary
MD5:E4E83F8123E9740B8AA3C3DFA77C1C04
SHA256:6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
1324WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.jsonbinary
MD5:F1B59332B953B3C99B3C95A44249C0D2
SHA256:138E49660D259061D8152137ABD8829ACDFB78B69179890BEB489FE3FFE23E0C
1324WINWORD.EXEC:\Users\admin\AppData\Local\Temp\3AB6E3F.tmpbinary
MD5:EF1FA8818BBB17FAEC3C7350D622F2D9
SHA256:12379444D12FCDEC499D96DD46FFBB3B05EACDD868C461037BC38E753F9BF334
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
91
DNS requests
32
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
192.168.100.2:445
—
—
—
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
192.168.100.2:139
—
—
—
whitelisted
—
—
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4180
rundll32.exe
192.168.100.1:445
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.65
  • 20.190.160.2
  • 20.190.160.130
  • 20.190.160.131
  • 20.190.160.22
  • 20.190.160.128
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
roaming.officeapps.live.com
  • 52.109.32.7
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
omex.cdn.office.net
  • 23.50.131.87
  • 23.50.131.86
whitelisted
fs.microsoft.com
  • 23.212.222.21
whitelisted
messaging.engagement.office.com
  • 52.111.231.8
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BadRabbit.exe