Overview

overview

10

Static

static

dd5d4cf942...le.exe

windows7_x64

10

dd5d4cf942...le.exe

windows10_x64

10

Analysis

  • max time kernel
    71s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    26-07-2021 12:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4.sample.exe

  • Size

    48KB

  • MD5

    1ee5456c1226affd7b72bcdf3db443b7

  • SHA1

    e22344a92c91b567a6cba7eb66686c438d479462

  • SHA256

    dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4

  • SHA512

    326e647615cab28c2a9e065ad628059b739d207a319c6631f9ed57a97548c67565c096d7227a6dc880484b65013977e95dd25e3ec8258c5e43c4567f0d86af00

Score
10/10
ragnarlockerbootkitpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_3CA64D43.txt

Family

ragnarlocker

Ransom Note
***************************************************************************************************************** HELLO GST_AutoLeather ! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Shutdown or reset your system ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special decryption key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities Don't waste your TIME, the link for contacting us will be deleted if there is no contact made in closest future and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. WARNING ! We had downloaded more than 1TB of your private information including billing info, clients private data, contracts, agreements and a lot of other sensitive information. Also we get everything from such files as "topsecret.doc" where was an access to your's SQL databases, Sharepoints, Barracuda Backups, Admin credentials and other services. You can check some proofs here: https://prnt.sc/s1xrct https://prnt.sc/s1xrpe https://prnt.sc/s1xs5s https://prnt.sc/s1xt9j Whole data gathered from your SECRET files and directories could be published for everyone's view and your partners, clients and investors would be notified about leak. However if we make a deal everything would be kept in secret and all your data will be restored. You can take a look on some examples of what we have, right now it's a private hidden page. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/in-project-temporarypage-18-04/ to view the page's content use password: leather9912gst013 ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://stppd5as5x4hxs45.onion/client/?1cdCAFdD70D2Eb1E078BCDED49fAb75d6315592715f319aFcb3c6106eFda88a2 c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/in-project-temporarypage-18-04/ ( password: leather9912gst013 ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---RAGNAR SECRET--- MWNkQ0FGZEQ3MEQyRWIxRTA3OEJDREVENDlmQWI3NWQ2MzE1NTkyNzE1ZjMxOWFGY2IzYzYxMDZlRmRhODhhMg== ---RAGNAR SECRET--- ***********************************************************************************
URLs

https://prnt.sc/s1xrct

https://prnt.sc/s1xrpe

https://prnt.sc/s1xs5s

https://prnt.sc/s1xt9j

http://p6o7m73ujalhgkiv.onion/in-project-temporarypage-18-04/

http://stppd5as5x4hxs45.onion/client/?1cdCAFdD70D2Eb1E078BCDED49fAb75d6315592715f319aFcb3c6106eFda88a2

Signatures

  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    ransomwareragnarlocker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
    • C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:284
    • C:\Windows\SysWOW64\notepad.exe
      C:\Users\Public\Documents\RGNR_3CA64D43.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1512
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\RGNR_3CA64D43.txt
    MD5

    d3375f69a9bb73dd94aaae48ea9fd29b

    SHA1

    b69f1a809f42791270e853d1ece954971ab94adb

    SHA256

    9a8e37e19cd45d041fccb8f0b69eb57b25b16b014a68aa99af989495384bafa7

    SHA512

    6d0fc6fff3ada0e49a771aa90e39627ffa5e8bb8e9be42e9e928eaffcbec48aee79302d2deba90345df82637c015cee4a5e88a48585c165bffcd49df93d39e20

    Download Submit
  • memory/284-62-0x0000000000000000-mapping.dmp
    Download
  • memory/1512-63-0x0000000000000000-mapping.dmp
    Download
  • memory/1692-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1836-60-0x00000000752F1000-0x00000000752F3000-memory.dmp
    Filesize

    8KB

    Download