Analysis
-
max time kernel
83s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-06-2021 10:07
General
-
Target
ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
-
Size
54KB
-
MD5
be6adee5c7c72c3c1d2094e544f2eead
-
SHA1
c9c2ad344d82c9977758488cff181d5474884d11
-
SHA256
ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79
-
SHA512
52a46a826097f20831df0d179494628dee536afd32cd8b5ff3140801381f2c98f09cfe1c01ff3f3611069570fa8232dfb4c7527f3e31f0142f5492a0c37d2f86
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Documents\!$R4GN4R_A3ED31EC$!.txt
Family
ragnarlocker
Ransom Note
*****************************************************************************************************************
HELLO test_comapny !
IF YOU ARE READING THIS, IT'S MEAN YOUR DATA WAS ENCRYPTED AND YOU SENSITIVE PRIVATE INFORMATION WAS STOLEN!
READ CAREFULLY THE WHOLE INSTRUCTION NOTES TO AVOID DIFFICULTIES WITH YOUR DATA
by RAGNAR_LOCKER !
*****************************************************************************************************************
*YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL*
(contact information you will find at the bottom of this notes)
!!!!! WARNING !!!!!
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES
-------------------------------------
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES
==============================================================================================================
! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
a) Download and install TOR browser from this site : https://torproject.org
b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?0242cdcD7eecbbAcB371c06DDC8feBAD516219353c5369dCBb5da0DfD6Ac94bc
c) To visit our NEWS LEAK BLOG with your data, open this website : http://p6o7m73ujalhgkiv.onion/
d) If Tor is restricted in your area, use VPN
When you open LIVE CHAT website follow rules :
Follow the instructions on the website.
At the top you will find CHAT tab.
Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn).
***********************************************************************************
---BEGIN KEY R_R---
MDI0MmNkY0Q3ZWVjYmJBY0IzNzFjMDZEREM4ZmVCQUQ1MTYyMTkzNTNjNTM2OWRDQmI1ZGEwRGZENkFjOTRiYw==
---END KEY R_R---
***********************************************************************************
URLs
http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?0242cdcD7eecbbAcB371c06DDC8feBAD516219353c5369dCBb5da0DfD6Ac94bc
http://p6o7m73ujalhgkiv.onion/
Signatures
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe"C:\Users\Admin\AppData\Local\Temp\ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {globalsettings} advancedoptions false2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken