Create Cab Files Ware' title='Create Cab Files Ware' />Once executed, Infpub. CWindowscscc. dat and CWindowsdispci. The Cscc. dat file is actually a renamed copy of the dcrypt. Filter. PeaZip is a free tool for creating and opening ZIP files quickly and easily. PeaZip can read RAR files, but it cannot write them, the one missing archive. How to Convince Your Boss to Let You Work From Home. Telecommuting is pretty easy now. Skype, Slack, and good ol Gchatexcuse me, Google Hangoutsmake communicating with your colleagues down the hall or around the world a breeze whether youre in the office or not. But if youre concerned about starting a telecommute program, or want to start a trial run with your boss, be sure to start small, and provide feedback thatll help you work from home again in the future. Start Small, Because You Might Hate It. If youve never worked from home before, going whole hog from the start might lead to disaster. If your office environment isnt set up for telecommuting, or you find yourself missing the camaraderie of having coworkers, you could find yourself distracted, frustrated, or unprepared to deal with the newfound freedom. You can start by proposing a one day per week telecommute schedule, perhaps on a slower workday. Picking a single day, like a Friday when work slows down, lets you plan your day around what you will and wont have access to at the office. The constraint will also help you schedule your meetings so no one in your company is trying to find you when youre at your home office. Oh, and be sure to set up your home office so you have everything youd normally need at work, just in case. Use Evidence to Make Your Case. Your boss might be skeptical of letting one of their own work without actually being in the office, but the research and actual results of remote works benefits are hard to ignore. A lot has been made about the productivity benefits of the four day workweekeither in the form ofRead more Read. A Stanford University study used a 2. The travel agency also brought in up to 2,0. Report Good and Bad Feedback. Compiling a list of things that went well will show your employer how serious youre taking the opportunity to work remotely. Outline what went well, how much work youve accomplished while working from home, and what you think you or your boss can do to make the experience more productive. It will give your employer good reason to boost your telecommute time, and show how youre thinking about ways to enhance the experience. A list of problems that may have arisen during your remote work will also show how youre working on ways to make telecommuting as frictionless as possible. If you find people asking where you are when youre working from home, or demanding your in person attention when youre out, that may require a solution you and your team can figure out together. Bad Rabbit Ransomware Outbreak in Russia and Ukraine. Overview. On October 2. Russia and Eastern Europe. The infections are believed to have initiated on October 2. UTC, evidenced by an infected companys tweet as shown in Figure 1. The ransomware, dubbed Bad Rabbit, has infected a number of organizations across Russia and eastern Europe, including the Russian news agency Interfax and machines in the Kiev Metro. The Odessa International airport in Ukraine has also confirmed that it was targeted with a cyber attack which caused delays in flights, however, it is unclear if this attack is Bad Rabbit. Uw Clinical Psychology Program. At the time of this writing, the threat actorgroup behind this attack is unknown. Figure 1 Interfax News stating on Twitter that the servers have failed due to a virus attack. Bad Rabbit is believed to be a variant of the Diskcoder ransomware other sources compare Bad Rabbit to the PetyaNot. PetyaEx. Petr ransomware, and possibly a new variant of Petya. The initial infection vector for the malware is believed to be conducted via compromised Russian websites drive by downloads, and a fake Adobe Flash Player installer Figure 3. Additionally, the ransomware is able to propagate itself through a network via Server Message Block SMB. If the ransomware infects a machine, the user will be presented with a ransom note with red letters on reboot. Interestingly, this is the same format used for the Petya attacks in June 2. The actorgroup requests 0. BTC approximately 2. USD for the decryption key. Furthermore, the ransom note depicts a countdown, beginning at 4. Countries with Bad Rabbit Infections. Bulgaria. Germany. Russia. Turkey. Ukraine. Affected Organizations. Fontanka. ru. Interfax News. Kiev Metro. Ministry of Infrastructure of Ukraine. Odessa International Airport. Analysis. Infection Vector. It appears that the ransomware dropper was delivered by drive by downloads on a number of compromised legitimate sites. All compromised sites were news and media websites. A pop up displays that an update for Adobe Flash is available, with an install button. The dropper downloads from http 1dnscontrol. The download is a Windows executable file with a Flash icon, as shown in Figure 2. The dropper is signed with two invalid digital certificates, masquerading as certificates issued by Symantec Corporation Figure 3. Figure 4 shows some details extracted from the sample. Figure 2 Dropper with Flash Icon. Figure 3 Digital Certificate used on Dropper. Figure 4 Details for Fake Adobe Flash Player Installer. Ransomware. The dropper creates a file called infpub. Windows folder. This file is a DLL file which is executed by the dropper by creating the process C WindowsSys. WOW6. 4rundll. 32. C Windowssystem. C Windowsinfpub. This DLL performs most of the actions. The ransomware targets and encrypts files with the following file extensions 3ds, 7z, accdb, ai, asm, asp, aspx, avhd, back, bak, bmp, brw, c, cab, cc, cer, cfg, conf, cpp, crt, cs, ctl, cxx, dbf, der, dib, disk, djvu, doc, docx, dwg, eml, fdb, gz, h, hdd, hpp, hxx, iso, java, jfif, jpe, jpeg, jpg, js, kdbx, key, mail, mdb, msg, nrg, odc, odf, odg, odi, odm, odp, ods, odt, ora, ost, ova, ovf, p. Once the encryption process is finished, Bad Rabbit drops the decrypter details from the file are shown in Figure 5 at C Windowsdispci. The added scheduled task is shown in Figure 6. The task is created by the execution of the following command. C WindowsSys. WOW6. Create RU SYSTEM SC ONSTART TN rhaegal TR C Windowssystem. C Start C Windowsdispci. Figure 5 Details for the decrypter dropped by the malware. Figure 6 Scheduled task for executing the decrypter at startup. The ID is different for each infected machine. The task is named rhaegal, which is the name of one of the dragons in the television show Game of Thrones. The decrypter removes the scheduled task once it is started. This can be seen in Figure 7. Figure 7 The beginning of the decrypters Main Function. Bad Rabbit will also ensure the machine is restarted approximately 1. Figure 8. The task is added by the following command. C WindowsSys. WOW6. Create SC once TN drogon RU SYSTEM TR C Windowssystem. ST 1. 8 0. 3 0. The timestamp is dependant on when the malware was executed. This task is named drogon, which is also the name of one of the dragons in Game of Thrones. Figure 8 Scheduled task for restarting the machine. Ransom Website. The ransom website is hosted on an. Tor network. It shows a colorful animation of text decrypting Figure 9 which reveals instructions for a victim to enter their personal installation code given in the ransom note. After following instructions the victim will then be assigned a bitcoin wallet address to deposit the ransom money for the actors. The assigned address is also used to verify that the payment has been made and to receive a decryption password according to the instructions Figure 1. The website was prepared at least a few days in advance of the attack because the Last Modified property of the index. Thursday, October 1. Figure 1. 1. Figure 9 Fake text decryption animation. Figure 1. 0 Bad Rabbit ransom payment hidden service. Figure 1. 1 Last Modified property of the index. Lateral Movement. Bad Rabbit uses DHCP to find other machines on the same subnet Figure 1. For each IP address on the network the malware checks if the host either has port 4. Figure 1. 3 by opening a network socket to the port. Figure 1. 2 Bad Rabbit uses DHCP to enumerate machines on the subnet. Figure 1. 3 Port checking by opening sockets to port 4. If the ports are open, Bad Rabbit will try to authenticate to the machine over SMBv. Figure 1. 4 using usernames and passwords it extracted from the host using Mimikatz and using a list of hardcoded usernames and passwords Figure 1. Using the credentials, it tries to connect to a set of named pipes Figure 1. Figure 1. 7. The file is executed on the remote host using IPC by calling the svcctl service. Figure 1. 4 SMBv. Figure 1. 5 Hard coded username and password combinations. Figure 1. 6 Hard coded list of named pipes the malware tries to access. Figure 1. 7 Writing the file to the ADMIN share and uses IPC to run it. Similarity to Ex. Petr Not. PetyaBad Rabbit shares many similarities with the Ex. Petr malware that spread throughout Europe and primarily in Ukraine in late June 2. Approximately 2. 7 of the code in the loader of Bad Rabbit is shared with Ex. Petr and the Bad Rabbit payload has approximately 1. Ex. Petr according to an Intezer report. The Bad Rabbit ransomware drops a file infpub. C Windows, which is similar to the perfc. Ex. Petr. According to Group IB researchers, the same vaccine technique used to block Ex. Petr can also be used for Bad Rabbit to prevent the victim from getting their files encrypted, which involves creating the. Conclusion. At the time of this writing, responders and researchers are still examining the Bad Rabbit attack. Anomali researchers will continue to stay engaged and post updates accordingly. We have now added a set of Bad Rabbit specific threat indicators to the Anomali Limo intelligence feed. Limo is a collection of free threat intelligence feeds that supports STIX and TAXII. Get more information. You may be familiar with STAXX our free client for subscribing to any STIXTAXII threat intelligence source.