Analysis
-
max time kernel
157s -
max time network
28s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:41
Static task
static1
Behavioral task
behavioral1
Sample
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe
Resource
win10v20210410
General
-
Target
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe
-
Size
798KB
-
MD5
987bcd521229b303fbe384def3b9be24
-
SHA1
81606251ea97a89f483a675bc819d545e7ff515a
-
SHA256
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36
-
SHA512
d8af7542607e2c9aace36accd594ef41c1334010917c64f7dfba806ca795715cfd967963924f732c2d4ebe7c36282bf8f96f6d971265c2a7b4b94c6d259e99b5
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_F540D252.txt
1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU
https://tox.chat/download.html
Signatures
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exedescription ioc process File opened (read-only) \??\E: 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue.css 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CET 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_07.MID 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382954.JPG 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18257_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\en-US\msadcor.dll.mui 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR14F.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14871_.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00405_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00459_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187849.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME08.CSS 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\PREVIEW.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153299.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Darwin 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0158007.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00419_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107262.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02268_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15273_.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00372_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR31F.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\HST10 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\STUBBY2.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14768_.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\RGNR_F540D252.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2028 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1324 wmic.exe Token: SeSecurityPrivilege 1324 wmic.exe Token: SeTakeOwnershipPrivilege 1324 wmic.exe Token: SeLoadDriverPrivilege 1324 wmic.exe Token: SeSystemProfilePrivilege 1324 wmic.exe Token: SeSystemtimePrivilege 1324 wmic.exe Token: SeProfSingleProcessPrivilege 1324 wmic.exe Token: SeIncBasePriorityPrivilege 1324 wmic.exe Token: SeCreatePagefilePrivilege 1324 wmic.exe Token: SeBackupPrivilege 1324 wmic.exe Token: SeRestorePrivilege 1324 wmic.exe Token: SeShutdownPrivilege 1324 wmic.exe Token: SeDebugPrivilege 1324 wmic.exe Token: SeSystemEnvironmentPrivilege 1324 wmic.exe Token: SeRemoteShutdownPrivilege 1324 wmic.exe Token: SeUndockPrivilege 1324 wmic.exe Token: SeManageVolumePrivilege 1324 wmic.exe Token: 33 1324 wmic.exe Token: 34 1324 wmic.exe Token: 35 1324 wmic.exe Token: SeBackupPrivilege 1152 vssvc.exe Token: SeRestorePrivilege 1152 vssvc.exe Token: SeAuditPrivilege 1152 vssvc.exe Token: SeIncreaseQuotaPrivilege 1324 wmic.exe Token: SeSecurityPrivilege 1324 wmic.exe Token: SeTakeOwnershipPrivilege 1324 wmic.exe Token: SeLoadDriverPrivilege 1324 wmic.exe Token: SeSystemProfilePrivilege 1324 wmic.exe Token: SeSystemtimePrivilege 1324 wmic.exe Token: SeProfSingleProcessPrivilege 1324 wmic.exe Token: SeIncBasePriorityPrivilege 1324 wmic.exe Token: SeCreatePagefilePrivilege 1324 wmic.exe Token: SeBackupPrivilege 1324 wmic.exe Token: SeRestorePrivilege 1324 wmic.exe Token: SeShutdownPrivilege 1324 wmic.exe Token: SeDebugPrivilege 1324 wmic.exe Token: SeSystemEnvironmentPrivilege 1324 wmic.exe Token: SeRemoteShutdownPrivilege 1324 wmic.exe Token: SeUndockPrivilege 1324 wmic.exe Token: SeManageVolumePrivilege 1324 wmic.exe Token: 33 1324 wmic.exe Token: 34 1324 wmic.exe Token: 35 1324 wmic.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exedescription pid process target process PID 1816 wrote to memory of 1324 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe wmic.exe PID 1816 wrote to memory of 1324 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe wmic.exe PID 1816 wrote to memory of 1324 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe wmic.exe PID 1816 wrote to memory of 1324 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe wmic.exe PID 1816 wrote to memory of 2028 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe vssadmin.exe PID 1816 wrote to memory of 2028 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe vssadmin.exe PID 1816 wrote to memory of 2028 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe vssadmin.exe PID 1816 wrote to memory of 2028 1816 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe"C:\Users\Admin\AppData\Local\Temp\0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.sample.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2028
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152