Overview

overview

10

Static

static

ac16f3e235...79.exe

windows7_x64

10

ac16f3e235...79.exe

windows10_x64

10

Resubmissions

21-06-2021 10:17

210621-vjwq4ygkgx 10

21-06-2021 10:07

210621-j7925dp9fj 10

Analysis

  • max time kernel
    68s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-06-2021 10:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

  • Size

    54KB

  • MD5

    be6adee5c7c72c3c1d2094e544f2eead

  • SHA1

    c9c2ad344d82c9977758488cff181d5474884d11

  • SHA256

    ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79

  • SHA512

    52a46a826097f20831df0d179494628dee536afd32cd8b5ff3140801381f2c98f09cfe1c01ff3f3611069570fa8232dfb4c7527f3e31f0142f5492a0c37d2f86

Score
10/10
ragnarlockerbootkitevasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\!$R4GN4R_3CA64D43$!.txt

Family

ragnarlocker

Ransom Note
***************************************************************************************************************** HELLO test_comapny ! IF YOU ARE READING THIS, IT'S MEAN YOUR DATA WAS ENCRYPTED AND YOU SENSITIVE PRIVATE INFORMATION WAS STOLEN! READ CAREFULLY THE WHOLE INSTRUCTION NOTES TO AVOID DIFFICULTIES WITH YOUR DATA by RAGNAR_LOCKER ! ***************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES ------------------------------------- TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?0242cdcD7eecbbAcB371c06DDC8feBAD516219353c5369dCBb5da0DfD6Ac94bc c) To visit our NEWS LEAK BLOG with your data, open this website : http://p6o7m73ujalhgkiv.onion/ d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN KEY R_R--- MDI0MmNkY0Q3ZWVjYmJBY0IzNzFjMDZEREM4ZmVCQUQ1MTYyMTkzNTNjNTM2OWRDQmI1ZGEwRGZENkFjOTRiYw== ---END KEY R_R--- ***********************************************************************************
URLs

http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?0242cdcD7eecbbAcB371c06DDC8feBAD516219353c5369dCBb5da0DfD6Ac94bc

http://p6o7m73ujalhgkiv.onion/

Signatures

  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    ransomwareragnarlocker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
    ransomwareevasion
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
    "C:\Users\Admin\AppData\Local\Temp\ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:668
    • C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:552
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:748
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:1504
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {globalsettings} advancedoptions false
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:788
    • C:\Windows\SysWOW64\notepad.exe
      C:\Users\Public\Documents\!$R4GN4R_3CA64D43$!.txt
      2⤵
        PID:1700
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1932

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Bootkit

    1
    T1067

    Privilege Escalation

    Defense Evasion

    File Deletion

    2
    T1107

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    3
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\Documents\!$R4GN4R_3CA64D43$!.txt
      MD5

      0c734d7a58ffd525ea35ac18847cf924

      SHA1

      9058ac4c0ef1a487538bc820d415dff1e9ec9c05

      SHA256

      7751e007627edaa208c9a8f4e04631acb8c7f6040a0c2c2cfa98fbb7ca3d6d26

      SHA512

      ff93883021108112eb71f2eb2c85b9cbac9f97649befc3ec27fbe166fbb72bccff6cfb1d4c94ef304f9f5c2d4ec8565fc011a051444f25a3e30601b2e630ecc3

      Download Submit
    • memory/552-61-0x0000000000000000-mapping.dmp
      Download
    • memory/668-60-0x0000000000000000-mapping.dmp
      Download
    • memory/748-62-0x0000000000000000-mapping.dmp
      Download
    • memory/788-64-0x0000000000000000-mapping.dmp
      Download
    • memory/1504-63-0x0000000000000000-mapping.dmp
      Download
    • memory/1664-59-0x0000000075281000-0x0000000075283000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1700-65-0x0000000000000000-mapping.dmp
      Download