Analysis
-
max time kernel
4294183s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
02-03-2022 01:57
Static task
static1
Behavioral task
behavioral1
Sample
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe
Resource
win10v2004-en-20220113
General
-
Target
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe
-
Size
798KB
-
MD5
987bcd521229b303fbe384def3b9be24
-
SHA1
81606251ea97a89f483a675bc819d545e7ff515a
-
SHA256
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36
-
SHA512
d8af7542607e2c9aace36accd594ef41c1334010917c64f7dfba806ca795715cfd967963924f732c2d4ebe7c36282bf8f96f6d971265c2a7b4b94c6d259e99b5
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_2BF34AC9.txt
hello_psecu@protonmail.com
1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU
https://tox.chat/download.html
Signatures
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exedescription ioc process File renamed C:\Users\Admin\Pictures\ClearRequest.raw => C:\Users\Admin\Pictures\ClearRequest.raw.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File renamed C:\Users\Admin\Pictures\DisableRegister.crw => C:\Users\Admin\Pictures\DisableRegister.crw.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File renamed C:\Users\Admin\Pictures\SelectSearch.png => C:\Users\Admin\Pictures\SelectSearch.png.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Users\Admin\Pictures\WatchRename.tiff 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File renamed C:\Users\Admin\Pictures\WatchRename.tiff => C:\Users\Admin\Pictures\WatchRename.tiff.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Users\Admin\Pictures\BackupOpen.tiff 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File renamed C:\Users\Admin\Pictures\BackupOpen.tiff => C:\Users\Admin\Pictures\BackupOpen.tiff.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File renamed C:\Users\Admin\Pictures\CheckpointRead.png => C:\Users\Admin\Pictures\CheckpointRead.png.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File renamed C:\Users\Admin\Pictures\CheckpointShow.png => C:\Users\Admin\Pictures\CheckpointShow.png.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File renamed C:\Users\Admin\Pictures\ExitImport.crw => C:\Users\Admin\Pictures\ExitImport.crw.ragnar_2BF34AC9 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exedescription ioc process File opened (read-only) \??\E: 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\locale\he\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\VideoLAN\VLC\plugins\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.CFG 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186362.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\PHONE.XML 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PIXEL.INF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239191.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl.xml 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.ELM 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AWARDHM.POC 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\RSSFeeds.js 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239611.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00810_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\msaccess.exe.manifest 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\es-ES\sbdrop.dll.mui 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMARQ.XML 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10336_.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\Microsoft Games\Minesweeper\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18242_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8F.GIF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RGNR_2BF34AC9.txt 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00734_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00938_.WMF 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 516 vssadmin.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1856 notepad.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1836 wmic.exe Token: SeSecurityPrivilege 1836 wmic.exe Token: SeTakeOwnershipPrivilege 1836 wmic.exe Token: SeLoadDriverPrivilege 1836 wmic.exe Token: SeSystemProfilePrivilege 1836 wmic.exe Token: SeSystemtimePrivilege 1836 wmic.exe Token: SeProfSingleProcessPrivilege 1836 wmic.exe Token: SeIncBasePriorityPrivilege 1836 wmic.exe Token: SeCreatePagefilePrivilege 1836 wmic.exe Token: SeBackupPrivilege 1836 wmic.exe Token: SeRestorePrivilege 1836 wmic.exe Token: SeShutdownPrivilege 1836 wmic.exe Token: SeDebugPrivilege 1836 wmic.exe Token: SeSystemEnvironmentPrivilege 1836 wmic.exe Token: SeRemoteShutdownPrivilege 1836 wmic.exe Token: SeUndockPrivilege 1836 wmic.exe Token: SeManageVolumePrivilege 1836 wmic.exe Token: 33 1836 wmic.exe Token: 34 1836 wmic.exe Token: 35 1836 wmic.exe Token: SeIncreaseQuotaPrivilege 1836 wmic.exe Token: SeSecurityPrivilege 1836 wmic.exe Token: SeTakeOwnershipPrivilege 1836 wmic.exe Token: SeLoadDriverPrivilege 1836 wmic.exe Token: SeSystemProfilePrivilege 1836 wmic.exe Token: SeSystemtimePrivilege 1836 wmic.exe Token: SeProfSingleProcessPrivilege 1836 wmic.exe Token: SeIncBasePriorityPrivilege 1836 wmic.exe Token: SeCreatePagefilePrivilege 1836 wmic.exe Token: SeBackupPrivilege 1836 wmic.exe Token: SeRestorePrivilege 1836 wmic.exe Token: SeShutdownPrivilege 1836 wmic.exe Token: SeDebugPrivilege 1836 wmic.exe Token: SeSystemEnvironmentPrivilege 1836 wmic.exe Token: SeRemoteShutdownPrivilege 1836 wmic.exe Token: SeUndockPrivilege 1836 wmic.exe Token: SeManageVolumePrivilege 1836 wmic.exe Token: 33 1836 wmic.exe Token: 34 1836 wmic.exe Token: 35 1836 wmic.exe Token: SeBackupPrivilege 976 vssvc.exe Token: SeRestorePrivilege 976 vssvc.exe Token: SeAuditPrivilege 976 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exedescription pid process target process PID 1968 wrote to memory of 1836 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe wmic.exe PID 1968 wrote to memory of 1836 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe wmic.exe PID 1968 wrote to memory of 1836 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe wmic.exe PID 1968 wrote to memory of 1836 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe wmic.exe PID 1968 wrote to memory of 516 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe vssadmin.exe PID 1968 wrote to memory of 516 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe vssadmin.exe PID 1968 wrote to memory of 516 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe vssadmin.exe PID 1968 wrote to memory of 516 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe vssadmin.exe PID 1968 wrote to memory of 1856 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe notepad.exe PID 1968 wrote to memory of 1856 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe notepad.exe PID 1968 wrote to memory of 1856 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe notepad.exe PID 1968 wrote to memory of 1856 1968 0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe"C:\Users\Admin\AppData\Local\Temp\0aaa7a3596af6b1aae02b6e6ca878045360d467f96b0687363a9dce19ea60a36.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_2BF34AC9.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\RGNR_2BF34AC9.txtMD5
a542fcfee82ad3375a5adf7df8997d88
SHA1b6a001fae92f9e8f4d580438b7170fd29d4f0722
SHA25611d42766b1cb0b76e7d3d040ddd90ea8243992145d831852b277e3b0d670f1e0
SHA51289a81e4ea3746d4c880fe7a50f00b259c66938eb776a43c9f6518bdb3f3f3f4808a120451e09e3bbe82b5175924d17aaf36a9b60f4530888d1d1fb985ffd76e0
-
memory/1968-54-0x0000000075641000-0x0000000075643000-memory.dmpFilesize
8KB