ragnarlocker | ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79

General

Target

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
Size

54KB
MD5

be6adee5c7c72c3c1d2094e544f2eead
SHA1

c9c2ad344d82c9977758488cff181d5474884d11
SHA256

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79
SHA512

52a46a826097f20831df0d179494628dee536afd32cd8b5ff3140801381f2c98f09cfe1c01ff3f3611069570fa8232dfb4c7527f3e31f0142f5492a0c37d2f86

Score

10^/10

ragnarlocker bootkit evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\!$R4GN4R_F540D252$!.txt

Family

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO test_comapny ! IF YOU ARE READING THIS, IT'S MEAN YOUR DATA WAS ENCRYPTED AND YOU SENSITIVE PRIVATE INFORMATION WAS STOLEN! READ CAREFULLY THE WHOLE INSTRUCTION NOTES TO AVOID DIFFICULTIES WITH YOUR DATA by RAGNAR_LOCKER ! ***************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES ------------------------------------- TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES TEST NOTES ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?0242cdcD7eecbbAcB371c06DDC8feBAD516219353c5369dCBb5da0DfD6Ac94bc c) To visit our NEWS LEAK BLOG with your data, open this website : http://p6o7m73ujalhgkiv.onion/ d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN KEY R_R--- MDI0MmNkY0Q3ZWVjYmJBY0IzNzFjMDZEREM4ZmVCQUQ1MTYyMTkzNTNjNTM2OWRDQmI1ZGEwRGZENkFjOTRiYw== ---END KEY R_R--- ***********************************************************************************

URLs

http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?0242cdcD7eecbbAcB371c06DDC8feBAD516219353c5369dCBb5da0DfD6Ac94bc

http://p6o7m73ujalhgkiv.onion/

Signatures

RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exe

pid process

1204 bcdedit.exe
1352 bcdedit.exe
2036 bcdedit.exe

pid	process
1204	bcdedit.exe
1352	bcdedit.exe
2036	bcdedit.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

description	ioc	process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

description ioc process

File opened (read-only) \??\E: ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

description	ioc	process
File opened (read-only)	\??\E:	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

Drops file in Program Files directory 64 IoCs

Processes:

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\release	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.REST.IDX_DLL	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLMAILR.FAE	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\PREVIEW.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02223U.BMP	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.jpg	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutSyncPC.ico	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\CASCADE.ELM	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\PREVIEW.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00350_.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Training.potx	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Oral	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBOX.DPV	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02736U.BMP	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\INDOMAIN.ICO	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.HK.XML	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386485.JPG	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\LEVEL.ELM	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297185.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files\Java\jre7\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\BLUEPRNT.INF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107350.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR10F.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\EST	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14516_.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\REMINDER.WAV	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\12.png	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baku	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00703L.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05870_.WMF	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\!$R4GN4R_F540D252$!.txt	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1788 vssadmin.exe

pid	process
1788	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

pid	process
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exewmic.exevssvc.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
Token: SeRestorePrivilege	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
Token: SeIncreaseQuotaPrivilege	1888	wmic.exe
Token: SeSecurityPrivilege	1888	wmic.exe
Token: SeTakeOwnershipPrivilege	1888	wmic.exe
Token: SeLoadDriverPrivilege	1888	wmic.exe
Token: SeSystemProfilePrivilege	1888	wmic.exe
Token: SeSystemtimePrivilege	1888	wmic.exe
Token: SeProfSingleProcessPrivilege	1888	wmic.exe
Token: SeIncBasePriorityPrivilege	1888	wmic.exe
Token: SeCreatePagefilePrivilege	1888	wmic.exe
Token: SeBackupPrivilege	1888	wmic.exe
Token: SeRestorePrivilege	1888	wmic.exe
Token: SeShutdownPrivilege	1888	wmic.exe
Token: SeDebugPrivilege	1888	wmic.exe
Token: SeSystemEnvironmentPrivilege	1888	wmic.exe
Token: SeRemoteShutdownPrivilege	1888	wmic.exe
Token: SeUndockPrivilege	1888	wmic.exe
Token: SeManageVolumePrivilege	1888	wmic.exe
Token: 33	1888	wmic.exe
Token: 34	1888	wmic.exe
Token: 35	1888	wmic.exe
Token: SeBackupPrivilege	1880	vssvc.exe
Token: SeRestorePrivilege	1880	vssvc.exe
Token: SeAuditPrivilege	1880	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1888	wmic.exe
Token: SeSecurityPrivilege	1888	wmic.exe
Token: SeTakeOwnershipPrivilege	1888	wmic.exe
Token: SeLoadDriverPrivilege	1888	wmic.exe
Token: SeSystemProfilePrivilege	1888	wmic.exe
Token: SeSystemtimePrivilege	1888	wmic.exe
Token: SeProfSingleProcessPrivilege	1888	wmic.exe
Token: SeIncBasePriorityPrivilege	1888	wmic.exe
Token: SeCreatePagefilePrivilege	1888	wmic.exe
Token: SeBackupPrivilege	1888	wmic.exe
Token: SeRestorePrivilege	1888	wmic.exe
Token: SeShutdownPrivilege	1888	wmic.exe
Token: SeDebugPrivilege	1888	wmic.exe
Token: SeSystemEnvironmentPrivilege	1888	wmic.exe
Token: SeRemoteShutdownPrivilege	1888	wmic.exe
Token: SeUndockPrivilege	1888	wmic.exe
Token: SeManageVolumePrivilege	1888	wmic.exe
Token: 33	1888	wmic.exe
Token: 34	1888	wmic.exe
Token: 35	1888	wmic.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe

description	pid	process	target process
PID 520 wrote to memory of 1888	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	wmic.exe
PID 520 wrote to memory of 1888	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	wmic.exe
PID 520 wrote to memory of 1888	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	wmic.exe
PID 520 wrote to memory of 1888	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	wmic.exe
PID 520 wrote to memory of 1788	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	vssadmin.exe
PID 520 wrote to memory of 1788	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	vssadmin.exe
PID 520 wrote to memory of 1788	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	vssadmin.exe
PID 520 wrote to memory of 1788	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	vssadmin.exe
PID 520 wrote to memory of 1204	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 1204	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 1204	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 1204	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 1352	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 1352	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 1352	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 1352	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 2036	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 2036	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 2036	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe
PID 520 wrote to memory of 2036	520	ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe	bcdedit.exe

C:\Users\Admin\AppData\Local\Temp\ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe
"C:\Users\Admin\AppData\Local\Temp\ac16f3e23516cf6b22830c399b4aba9706d37adceb5eb8ea9960f71f1425df79.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1204
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1352
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2036
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\!$R4GN4R_F540D252$!.txt
  2⤵
  PID:1352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\!$R4GN4R_F540D252$!.txt
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Desktop\!$R4GN4R_F540D252$!.txt

MD5
0c734d7a58ffd525ea35ac18847cf924

SHA1
9058ac4c0ef1a487538bc820d415dff1e9ec9c05

SHA256
7751e007627edaa208c9a8f4e04631acb8c7f6040a0c2c2cfa98fbb7ca3d6d26

SHA512
ff93883021108112eb71f2eb2c85b9cbac9f97649befc3ec27fbe166fbb72bccff6cfb1d4c94ef304f9f5c2d4ec8565fc011a051444f25a3e30601b2e630ecc3

Download Submit
C:\Users\Public\Documents\!$R4GN4R_F540D252$!.txt

MD5
0c734d7a58ffd525ea35ac18847cf924

SHA1
9058ac4c0ef1a487538bc820d415dff1e9ec9c05

SHA256
7751e007627edaa208c9a8f4e04631acb8c7f6040a0c2c2cfa98fbb7ca3d6d26

SHA512
ff93883021108112eb71f2eb2c85b9cbac9f97649befc3ec27fbe166fbb72bccff6cfb1d4c94ef304f9f5c2d4ec8565fc011a051444f25a3e30601b2e630ecc3

Download Submit
memory/520-59-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1204-62-0x0000000000000000-mapping.dmp

Download
memory/1352-63-0x0000000000000000-mapping.dmp

Download
memory/1352-65-0x0000000000000000-mapping.dmp

Download
memory/1496-68-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

Filesize
8KB

Download
memory/1788-61-0x0000000000000000-mapping.dmp

Download
memory/1888-60-0x0000000000000000-mapping.dmp

Download
memory/2036-64-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads