Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
data
-
Size
204KB
-
Sample
211018-kxt83sebfl
-
MD5
fcd9a9e76d99cf8b85a817eee770a333
-
SHA1
1a7a938bb4b88c9a840c0f2935663d3a207c3f26
-
SHA256
0766beb30c575fc68d1ca134bd53c086d2ce63b040e4d0bbd6d89d8c26ca04f6
-
SHA512
ae1c9536e717efebd175ba6cd820740a007c0b31bdcff94aab6b55f940aee4e2406a1e1d6a83ca410ff0018ea049b856a3dc914c49faa3cf74b9e557faab58e5
Static task
static1
Behavioral task
behavioral1
Sample
data.exe
Resource
win10-en-20210920
Malware Config
Extracted
C:\Users\Public\Documents\!!!_READ_ME_7E8535F5_!!!.txt
ragnarlocker
https://prnt.sc/v36ygd
https://prnt.sc/v37089
https://prnt.sc/v36yxt
https://prnt.sc/v36zio
https://prnt.sc/v36xi8
https://prnt.sc/v370oi
http://p6o7m73ujalhgkiv.onion/?38KP4j2zYlWcWRm6zsLg
http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?384fAE1DDC9DE3D3b670f7961AEEAA6DBDaCfb972D6Fff48Baf0bcc6c1da2FAc
http://p6o7m73ujalhgkiv.onion/?http://p6o7m73ujalhgkiv.onion/?38KP4j2zYlWcWRm6zsLg
Targets
-
-
Target
data
-
Size
204KB
-
MD5
fcd9a9e76d99cf8b85a817eee770a333
-
SHA1
1a7a938bb4b88c9a840c0f2935663d3a207c3f26
-
SHA256
0766beb30c575fc68d1ca134bd53c086d2ce63b040e4d0bbd6d89d8c26ca04f6
-
SHA512
ae1c9536e717efebd175ba6cd820740a007c0b31bdcff94aab6b55f940aee4e2406a1e1d6a83ca410ff0018ea049b856a3dc914c49faa3cf74b9e557faab58e5
Score10/10-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Modifies boot configuration data using bcdedit
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-