Overview

overview

10

Static

static

3bc8ce79ee...e1.exe

windows7-x64

10

3bc8ce79ee...e1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2022 12:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3bc8ce79ee7043c9ad70698e3fc2013806244dc5112c8c8d465e96757b57b1e1.exe

  • Size

    48KB

  • MD5

    48c0edeea7a6fda6646c3cdb9630a964

  • SHA1

    18c1dfe6e5e401d4fb4f309af2daae166816bd97

  • SHA256

    3bc8ce79ee7043c9ad70698e3fc2013806244dc5112c8c8d465e96757b57b1e1

  • SHA512

    969b44e9d5e53a3f82767e9bd67ff47b85f3b53318d6ceb2cc03d4a7d255161b752f87220bfbccce954810a948b34626f0bdda30ede289a0569e7f8e18ab533c

  • SSDEEP

    768:9zsfaMDiZ2oq65co7Bjd/3oqab0k3RW2X0oj+cykcN:9zFMq2o4qFoqaXiu+nkc

Score
10/10
ragnarlockerbootkitpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_77206419.txt

Family

ragnarlocker

Ransom Note
***************************************************************************************************************** HELLO Omniga.de ! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Shutdown or reset your system ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special decryption key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities Don't waste your TIME, the link for contacting us will be deleted if there is no contact made in closest future and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. WARNING ! We had downloaded your private information including billing info, clients private data, contracts, agreements and a lot of other sensitive information. Also we take your SQL server DB,access to leadership's mails and correspondence, admin credentials, VPN-servers, Backup shares, Cloud host, and a lot of other info from your Network. You can check some proofs here: https://prnt.sc/s5g6gr https://prnt.sc/s5g79t https://prnt.sc/s5gkxh Whole data gathered from your SECRET files and directories could be published for everyone's view and your partners, clients and investors would be notified about leak. However if we make a deal everything would be kept in secret and all your data will be restored. You can take a look on some examples of what we have, right now it's a private hidden page. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/temporary-de-page-424/ to view the page's content use password: OmnigUdk$912f If you wouldn't PAY, we will publish this post with much more information available for Downloading. In mass media breaking news about the leak will make a lot of noise in every IT-journals, blogs, sites etc. Besides, your private data will be sold out on Darknet forums! To avoid such troubles and lawsuits from your clients and partners it's better to make a deal with us. ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://stppd5as5x4hxs45.onion/client/?0dFE0B7BAA7C7801ddd746B1DC5ad44bAD82Fc0f77DAC01bD3cf3D2D9deB94bC c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/temporary-de-page-424/ ( password: OmnigUdk$912f ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---RAGNAR SECRET--- MGRGRTBCN0JBQTdDNzgwMWRkZDc0NkIxREM1YWQ0NGJBRDgyRmMwZjc3REFDMDFiRDNjZjNEMkQ5ZGVCOTRiQw== ---RAGNAR SECRET--- ***********************************************************************************
URLs

https://prnt.sc/s5g6gr

https://prnt.sc/s5g79t

https://prnt.sc/s5gkxh

http://p6o7m73ujalhgkiv.onion/temporary-de-page-424/

http://stppd5as5x4hxs45.onion/client/?0dFE0B7BAA7C7801ddd746B1DC5ad44bAD82Fc0f77DAC01bD3cf3D2D9deB94bC

Signatures

  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    ransomwareragnarlocker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bc8ce79ee7043c9ad70698e3fc2013806244dc5112c8c8d465e96757b57b1e1.exe
    "C:\Users\Admin\AppData\Local\Temp\3bc8ce79ee7043c9ad70698e3fc2013806244dc5112c8c8d465e96757b57b1e1.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2392
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:4060
    • C:\Windows\SysWOW64\notepad.exe
      C:\Users\Public\Documents\RGNR_77206419.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      • Suspicious use of FindShellTrayWindow
      PID:4300
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\RGNR_77206419.txt
    Filesize

    3KB

    MD5

    41a65ea123c14240908dd33abffb288b

    SHA1

    947181da0844653e4aa35711009600f054555c80

    SHA256

    20c45e7c885c3c9b387d4e5c63646c6bbabc05969f1d36985c2f10b547e4cdb1

    SHA512

    817c2e9cca86f4389354968bcab8c06eb2c439126c509308ab4c936abe39400e79894f247611d4d4ea3edeabb9c3f1cbab3ccf837ecc2fbd4e222cdebcc47b02

    Download Submit
  • memory/2392-132-0x0000000000000000-mapping.dmp
    Download
  • memory/4060-133-0x0000000000000000-mapping.dmp
    Download
  • memory/4300-134-0x0000000000000000-mapping.dmp
    Download