Analysis
-
max time kernel
1692s -
max time network
1699s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 11:36
Static task
static1
Behavioral task
behavioral1
Sample
Sample_5e5422e8465bf10010d575c3.bin.exe
Resource
win10
General
-
Target
Sample_5e5422e8465bf10010d575c3.bin.exe
-
Size
39KB
-
MD5
7529e3c83618f5e3a4cc6dbf3a8534a6
-
SHA1
0f944504eebfca5466b6113853b0d83e38cf885a
-
SHA256
ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
-
SHA512
7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_2D08E9B5.txt
cargowelcome@protonmail.com
1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4
https://tox.chat/download.html
Signatures
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Sample_5e5422e8465bf10010d575c3.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExportStep.tif => C:\Users\Admin\Pictures\ExportStep.tif.ragnar_2D08E9B5 Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Users\Admin\Pictures\UnlockDeny.tiff Sample_5e5422e8465bf10010d575c3.bin.exe File renamed C:\Users\Admin\Pictures\UnlockDeny.tiff => C:\Users\Admin\Pictures\UnlockDeny.tiff.ragnar_2D08E9B5 Sample_5e5422e8465bf10010d575c3.bin.exe File renamed C:\Users\Admin\Pictures\UnprotectSet.raw => C:\Users\Admin\Pictures\UnprotectSet.raw.ragnar_2D08E9B5 Sample_5e5422e8465bf10010d575c3.bin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Sample_5e5422e8465bf10010d575c3.bin.exedescription pid process target process PID 3588 wrote to memory of 3752 3588 Sample_5e5422e8465bf10010d575c3.bin.exe wmic.exe PID 3588 wrote to memory of 3752 3588 Sample_5e5422e8465bf10010d575c3.bin.exe wmic.exe PID 3588 wrote to memory of 3420 3588 Sample_5e5422e8465bf10010d575c3.bin.exe vssadmin.exe PID 3588 wrote to memory of 3420 3588 Sample_5e5422e8465bf10010d575c3.bin.exe vssadmin.exe PID 3588 wrote to memory of 3092 3588 Sample_5e5422e8465bf10010d575c3.bin.exe notepad.exe PID 3588 wrote to memory of 3092 3588 Sample_5e5422e8465bf10010d575c3.bin.exe notepad.exe PID 3588 wrote to memory of 3092 3588 Sample_5e5422e8465bf10010d575c3.bin.exe notepad.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 3092 notepad.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Sample_5e5422e8465bf10010d575c3.bin.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 Sample_5e5422e8465bf10010d575c3.bin.exe -
Drops startup file 1 IoCs
Processes:
Sample_5e5422e8465bf10010d575c3.bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe -
Drops file in Program Files directory 19502 IoCs
Processes:
Sample_5e5422e8465bf10010d575c3.bin.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeAppList.targetsize-32_altform-unplated.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-80.png Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\sysinfo Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Save.png Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Audio\firework1.wav Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\uy_60x42.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ui-strings.js Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\976_32x32x32.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\models\en-GB.PostalAddress.model Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\mc_60x42.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\Handler@1x.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\Texture_bg.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-400.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7734_32x32x32.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\km_16x11.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ro_16x11.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookIconFirstRunMail.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-white.png Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-200.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\Snooze.scale-80.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\Icon.targetsize-256.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\Products.txt Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.16112.11601.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\bl_16x11.png Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011 Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files\Windows Media Player\Skins\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Stamp.aapp Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File created C:\Program Files (x86)\Common Files\Java\RGNR_2D08E9B5.txt Sample_5e5422e8465bf10010d575c3.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms Sample_5e5422e8465bf10010d575c3.bin.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3752 wmic.exe Token: SeSecurityPrivilege 3752 wmic.exe Token: SeTakeOwnershipPrivilege 3752 wmic.exe Token: SeLoadDriverPrivilege 3752 wmic.exe Token: SeSystemProfilePrivilege 3752 wmic.exe Token: SeSystemtimePrivilege 3752 wmic.exe Token: SeProfSingleProcessPrivilege 3752 wmic.exe Token: SeIncBasePriorityPrivilege 3752 wmic.exe Token: SeCreatePagefilePrivilege 3752 wmic.exe Token: SeBackupPrivilege 3752 wmic.exe Token: SeRestorePrivilege 3752 wmic.exe Token: SeShutdownPrivilege 3752 wmic.exe Token: SeDebugPrivilege 3752 wmic.exe Token: SeSystemEnvironmentPrivilege 3752 wmic.exe Token: SeRemoteShutdownPrivilege 3752 wmic.exe Token: SeUndockPrivilege 3752 wmic.exe Token: SeManageVolumePrivilege 3752 wmic.exe Token: 33 3752 wmic.exe Token: 34 3752 wmic.exe Token: 35 3752 wmic.exe Token: 36 3752 wmic.exe Token: SeBackupPrivilege 584 vssvc.exe Token: SeRestorePrivilege 584 vssvc.exe Token: SeAuditPrivilege 584 vssvc.exe Token: SeIncreaseQuotaPrivilege 3752 wmic.exe Token: SeSecurityPrivilege 3752 wmic.exe Token: SeTakeOwnershipPrivilege 3752 wmic.exe Token: SeLoadDriverPrivilege 3752 wmic.exe Token: SeSystemProfilePrivilege 3752 wmic.exe Token: SeSystemtimePrivilege 3752 wmic.exe Token: SeProfSingleProcessPrivilege 3752 wmic.exe Token: SeIncBasePriorityPrivilege 3752 wmic.exe Token: SeCreatePagefilePrivilege 3752 wmic.exe Token: SeBackupPrivilege 3752 wmic.exe Token: SeRestorePrivilege 3752 wmic.exe Token: SeShutdownPrivilege 3752 wmic.exe Token: SeDebugPrivilege 3752 wmic.exe Token: SeSystemEnvironmentPrivilege 3752 wmic.exe Token: SeRemoteShutdownPrivilege 3752 wmic.exe Token: SeUndockPrivilege 3752 wmic.exe Token: SeManageVolumePrivilege 3752 wmic.exe Token: 33 3752 wmic.exe Token: 34 3752 wmic.exe Token: 35 3752 wmic.exe Token: 36 3752 wmic.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3420 vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sample_5e5422e8465bf10010d575c3.bin.exe"C:\Users\Admin\AppData\Local\Temp\Sample_5e5422e8465bf10010d575c3.bin.exe"1⤵
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
- Writes to the Master Boot Record (MBR)
- Drops startup file
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_2D08E9B5.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken