ragnarlocker | 6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8

General

Target

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
Size

116KB
MD5

8f6ba0f6712b0c5a6ad9c3663883e5cd
SHA1

ca0a98de71a2014e584dcb6a2b40d7a8a866a008
SHA256

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8
SHA512

e7aed7cfedf3e29add6fc2bdd1069c04670030ee29e64c527e5bc75c3eb84b09a7f9182621132aa0cb244683bb9bd71f4a2b1c9e2d6b5fd2d52c311a432503d3

Score

10^/10

ragnarlocker bootkit persistence ransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_271FEB00.txt

Family

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO EDP.com ! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Shutdown or reset your system ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special decryption key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities Don't waste your TIME, the link for contacting us will be deleted if there is no contact made in closest future and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ATTENTION ! We had downloaded more than 10TB of data from your fileservers and if you don't contact us for payment, we will publish it or sell to interested parties. Here is just a small part of your files that we have, for a proof (use Tor Browser for open the link) : http://p6o7m73ujalhgkiv.onion/?p=171 We gathered the most sensitive and confidential information about your transactions, billing, contracts, clients and partners. And be assure that if you wouldn't pay, all files and documents would be publicated for everyones view and also we would notify all your clients and partners about this leakage with direct links. So if you want to avoid such a harm for your reputation, better pay the amount that we asking for. ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/?page_id=171 d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---RAGNAR SECRET--- NmJFQ0EyYjJBRkZmQkMxRGZmMGFhMEVhYUFkNDY4YmVjMDkwM2I1ZTRFYTU4ZWNkZTNDMjY0YkM1NWM3Mzg5RQ== ---RAGNAR SECRET--- ***********************************************************************************

URLs

http://p6o7m73ujalhgkiv.onion/?p=171

http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E

http://p6o7m73ujalhgkiv.onion/?page_id=171

Signatures

RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConvertToClear.crw => C:\Users\Admin\Pictures\ConvertToClear.crw.ragnar_271FEB00	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

description ioc process

File opened (read-only) \??\E: 6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

description	ioc	process
File opened (read-only)	\??\E:	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe

Drops file in Program Files directory 10154 IoCs

Processes:

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART2.BDR	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\RGNR_271FEB00.txt	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\calendars.properties	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152560.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199465.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299125.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXC	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\RGNR_271FEB00.txt	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\RGNR_271FEB00.txt	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPQUOT.DPV	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.potx	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\resources.jar	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14538_.GIF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Equity.thmx	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MUSIC_01.MID	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195384.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR41F.GIF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File created	C:\Program Files\Windows Journal\Templates\RGNR_271FEB00.txt	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099196.GIF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\Groove Starter Template.xsn	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\GrooveFormsMetaData.xml	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239955.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\RGNR_271FEB00.txt	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDCNCLS.ICO	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01566_.WMF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR51B.GIF	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHDHM.POC	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1952 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

984 notepad.exe

pid	process
1952	vssadmin.exe

pid	process
984	notepad.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

pid	process
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2000	wmic.exe
Token: SeSecurityPrivilege	2000	wmic.exe
Token: SeTakeOwnershipPrivilege	2000	wmic.exe
Token: SeLoadDriverPrivilege	2000	wmic.exe
Token: SeSystemProfilePrivilege	2000	wmic.exe
Token: SeSystemtimePrivilege	2000	wmic.exe
Token: SeProfSingleProcessPrivilege	2000	wmic.exe
Token: SeIncBasePriorityPrivilege	2000	wmic.exe
Token: SeCreatePagefilePrivilege	2000	wmic.exe
Token: SeBackupPrivilege	2000	wmic.exe
Token: SeRestorePrivilege	2000	wmic.exe
Token: SeShutdownPrivilege	2000	wmic.exe
Token: SeDebugPrivilege	2000	wmic.exe
Token: SeSystemEnvironmentPrivilege	2000	wmic.exe
Token: SeRemoteShutdownPrivilege	2000	wmic.exe
Token: SeUndockPrivilege	2000	wmic.exe
Token: SeManageVolumePrivilege	2000	wmic.exe
Token: 33	2000	wmic.exe
Token: 34	2000	wmic.exe
Token: 35	2000	wmic.exe
Token: SeBackupPrivilege	1624	vssvc.exe
Token: SeRestorePrivilege	1624	vssvc.exe
Token: SeAuditPrivilege	1624	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2000	wmic.exe
Token: SeSecurityPrivilege	2000	wmic.exe
Token: SeTakeOwnershipPrivilege	2000	wmic.exe
Token: SeLoadDriverPrivilege	2000	wmic.exe
Token: SeSystemProfilePrivilege	2000	wmic.exe
Token: SeSystemtimePrivilege	2000	wmic.exe
Token: SeProfSingleProcessPrivilege	2000	wmic.exe
Token: SeIncBasePriorityPrivilege	2000	wmic.exe
Token: SeCreatePagefilePrivilege	2000	wmic.exe
Token: SeBackupPrivilege	2000	wmic.exe
Token: SeRestorePrivilege	2000	wmic.exe
Token: SeShutdownPrivilege	2000	wmic.exe
Token: SeDebugPrivilege	2000	wmic.exe
Token: SeSystemEnvironmentPrivilege	2000	wmic.exe
Token: SeRemoteShutdownPrivilege	2000	wmic.exe
Token: SeUndockPrivilege	2000	wmic.exe
Token: SeManageVolumePrivilege	2000	wmic.exe
Token: 33	2000	wmic.exe
Token: 34	2000	wmic.exe
Token: 35	2000	wmic.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe

description	pid	process	target process
PID 292 wrote to memory of 2000	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	wmic.exe
PID 292 wrote to memory of 2000	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	wmic.exe
PID 292 wrote to memory of 2000	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	wmic.exe
PID 292 wrote to memory of 2000	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	wmic.exe
PID 292 wrote to memory of 1952	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	vssadmin.exe
PID 292 wrote to memory of 1952	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	vssadmin.exe
PID 292 wrote to memory of 1952	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	vssadmin.exe
PID 292 wrote to memory of 1952	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	vssadmin.exe
PID 292 wrote to memory of 984	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	notepad.exe
PID 292 wrote to memory of 984	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	notepad.exe
PID 292 wrote to memory of 984	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	notepad.exe
PID 292 wrote to memory of 984	292	6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe
"C:\Users\Admin\AppData\Local\Temp\6fd4ec6611bf7e691be80483bcf860e827d513df45e20d78f29cf4638b6c20e8.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1952
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\RGNR_271FEB00.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\RGNR_271FEB00.txt

MD5
ebb1e76a32908e6653c933364985f639

SHA1
69fc0b1ed4cd4548bb4ebbe3d9f2bf7934735ff7

SHA256
1c6ab30444efec425084c396107d7f66371bfc526f6f11480263de22a8233c8f

SHA512
e35ebebb5c69e26127be6246ca44d8819cc19cbb7fa9eaa861367b414605eb71b66e440fd5bfa404ab950730053e87d5c7daf0bbab7296ee8bd724c81f730abe

Download Submit
memory/292-13-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-2-0x0000000002190000-0x00000000021A1000-memory.dmp

Filesize
68KB

Download
memory/292-45-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-5-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-9-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-15-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-19-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-29-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-33-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-37-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-27-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-41-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-23-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-0-0x0000000002190000-0x00000000021A1000-memory.dmp

Filesize
68KB

Download
memory/292-3-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-53-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-55-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-51-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-63-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-69-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-77-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-85-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-91-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-89-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-99-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/292-47-0x00000000025A0000-0x00000000025B1000-memory.dmp

Filesize
68KB

Download
memory/984-102-0x0000000000000000-mapping.dmp

Download
memory/1952-101-0x0000000000000000-mapping.dmp

Download
memory/2000-100-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads