Analysis
-
max time kernel
147s -
max time network
63s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
03-08-2020 10:01
General
-
Target
ragnar_locker_WEGLARZCO.bin.exe
-
Size
42KB
-
MD5
0fbbc59d4fe280a55c1fb6f5502c1e73
-
SHA1
af53890ed1d4753e7493d48862bdd7d18a2b11f6
-
SHA256
63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059
-
SHA512
20b87ac354cefa2b75e8edbe30b903c51e4f2c2cb49f59dd40732d964612a69b149cb10274feab5c6971c8adfc91fba11f1ebeba38e1b2d45c6b1b4d3dd37633
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Documents\RGNR_C37F73E1.txt
Family
ragnarlocker
Ransom Note
*****************************************************************************************************************
HELLO WEGLARZCO!
If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED
by RAGNAR_LOCKER !
*****************************************************************************************************************
!!!!! WARNING !!!!!
DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible.
DO NOT use any third party or public decryption software, it also may damage files.
DO NOT Reinstall your OS
DO NOT Delete readme files
-------------------------------------
There is ONLY ONE possible way to get back your files - contact us and pay for our special DECRYPTION key !
For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities.
Don't waste your TIME, the link for contacting us will be deleted in closest future if there is no contact made and you will never restore your DATA.
HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
а) Download and install TOR browser from this site : https://torproject.org
b) Open our website : http://mykgoj7uvqtgl367.onion/client/?61bcbDc31F1c894054C3B84aF53C35cF3005e1A69366A6e857a5a4fd60fb7184
c) If Tor is restricted in your area, use VPN
Follow the instructions on the website.
At the top you will find CHAT tab.
Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn).
***********************************************************************************
---RAGNAR SECRET---
NjFiY2JEYzMxRjFjODk0MDU0QzNCODRhRjUzQzM1Y0YzMDA1ZTFBNjkzNjZBNmU4NTdhNWE0ZmQ2MGZiNzE4NA==
---RAGNAR SECRET---
***********************************************************************************
URLs
http://mykgoj7uvqtgl367.onion/client/?61bcbDc31F1c894054C3B84aF53C35cF3005e1A69366A6e857a5a4fd60fb7184
Signatures
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Drops file in Program Files directory 19483 IoCs
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Drops startup file 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 74 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies service 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ragnar_locker_WEGLARZCO.bin.exe"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_WEGLARZCO.bin.exe"1⤵
- Drops file in Program Files directory
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Writes to the Master Boot Record (MBR)
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_C37F73E1.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
-