c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

Analysis

max time kernel
1580s
max time network
1596s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2022 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RansomwareSamples/Ranzy_20_11_2020_138KB.exe
Size

138KB
MD5

954479f95ce67fcb855c5b882d68e74b
SHA1

43ccf398999f70b613e1353cfb6845ee09b393ca
SHA256

c4f72b292750e9332b1f1b9761d5aefc07301bc15edf31adeaf2e608000ec1c9
SHA512

515e675401ec67d2d06f06264cb33808ad7d214a0609492ddf73f40a3b829358d75f79fff04b29c6953fc3f450c0d55207d5a6fd3b571f60ae05e25327c41a5f
SSDEEP

3072:WNnBEPCZ788hExMfHg/50iIETyyCDRk8gE9QIluYEh0VZvcWrMFh:WPEa586nHg/50/ET3CoE7uYEau

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\odt\readme.txt

Ransom Note

---=== Ranzy Locker 1.1 ===--- Attention! Your network has been locked. Your computers and server are locked now. All encrypted files have extension: .ranzy ---- How to restore my files? ---- All files on each host in your network encrypted with strongest encryption algorithms Backups are deleted or formatted, do not worry, we can help you restore your files Files can be decrypted only with private key - this key stored on our servers You have only one way for return your files back - contact us and receive universal decryption program Do not worry about guarantees - you can decrypt any 3 files FOR FREE as guarantee ---- Contact us ---- You have two way to contact us: 1. Open our recovery-website (can be open in any browser): https://ranzylock.hk/N6CFBPYX 2. In case of link doesnt work open our mirror recovery-website via TOR Browser: Download TOR Browser here: https://www.torproject.org/download/ Open TOR mirror website: http://a6a5b4ppnkrio3nikyutfexbc6y5dc6kfhj3jr32kdwbryr2lempkuyd.onion/N6CFBPYX ---- Data Leak Attention ---- !!! All your sensitive data was downloaded to our servers !!! We are ready to publish this data in our blog with your Company Name, if you will not contact with us by email !!! Only we can delete your files from our servers !!! Only we can restore all your files without any LOSS ---- Recovery information ---- key: eyJleHQiOiIucmFuenkiLCJuZXR3b3JrIjoidHJ1ZSIsInN1YmlkIjoiMTQzNzUiLCJsYW5nIjoiZW4tVVMAIn0= personal id: 10EKVPIH

URLs

https://ranzylock.hk/N6CFBPYX

http://a6a5b4ppnkrio3nikyutfexbc6y5dc6kfhj3jr32kdwbryr2lempkuyd.onion/N6CFBPYX

Signatures

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Ranzy_20_11_2020_138KB.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\OptimizeSave.tiff	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\OptimizeSave.tiff => C:\Users\Admin\Pictures\OptimizeSave.tiff.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\SkipSend.crw => C:\Users\Admin\Pictures\SkipSend.crw.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\UndoSend.tif => C:\Users\Admin\Pictures\UndoSend.tif.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\WriteResume.png => C:\Users\Admin\Pictures\WriteResume.png.ranzy	Ranzy_20_11_2020_138KB.exe
File opened for modification	C:\Users\Admin\Pictures\DisableBlock.tiff	Ranzy_20_11_2020_138KB.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertSearch.tiff	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\ConvertSearch.tiff => C:\Users\Admin\Pictures\ConvertSearch.tiff.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\DisableBlock.tiff => C:\Users\Admin\Pictures\DisableBlock.tiff.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\InvokeSwitch.tif => C:\Users\Admin\Pictures\InvokeSwitch.tif.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\ReadRepair.raw => C:\Users\Admin\Pictures\ReadRepair.raw.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\RestoreComplete.raw => C:\Users\Admin\Pictures\RestoreComplete.raw.ranzy	Ranzy_20_11_2020_138KB.exe
File renamed	C:\Users\Admin\Pictures\BackupUnlock.tif => C:\Users\Admin\Pictures\BackupUnlock.tif.ranzy	Ranzy_20_11_2020_138KB.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Ranzy_20_11_2020_138KB.exe

description	ioc	process
File opened (read-only)	\??\V:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\E:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\G:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\J:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\K:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\O:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\Q:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\U:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\H:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\I:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\N:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\R:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\S:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\W:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\A:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\P:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\T:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\B:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\F:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\L:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\M:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\X:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\Y:	Ranzy_20_11_2020_138KB.exe
File opened (read-only)	\??\Z:	Ranzy_20_11_2020_138KB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Ranzy_20_11_2020_138KB.exe

pid	process
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe
2444	Ranzy_20_11_2020_138KB.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4348	wmic.exe
Token: SeSecurityPrivilege	4348	wmic.exe
Token: SeTakeOwnershipPrivilege	4348	wmic.exe
Token: SeLoadDriverPrivilege	4348	wmic.exe
Token: SeSystemProfilePrivilege	4348	wmic.exe
Token: SeSystemtimePrivilege	4348	wmic.exe
Token: SeProfSingleProcessPrivilege	4348	wmic.exe
Token: SeIncBasePriorityPrivilege	4348	wmic.exe
Token: SeCreatePagefilePrivilege	4348	wmic.exe
Token: SeBackupPrivilege	4348	wmic.exe
Token: SeRestorePrivilege	4348	wmic.exe
Token: SeShutdownPrivilege	4348	wmic.exe
Token: SeDebugPrivilege	4348	wmic.exe
Token: SeSystemEnvironmentPrivilege	4348	wmic.exe
Token: SeRemoteShutdownPrivilege	4348	wmic.exe
Token: SeUndockPrivilege	4348	wmic.exe
Token: SeManageVolumePrivilege	4348	wmic.exe
Token: 33	4348	wmic.exe
Token: 34	4348	wmic.exe
Token: 35	4348	wmic.exe
Token: 36	4348	wmic.exe
Token: SeIncreaseQuotaPrivilege	2368	wmic.exe
Token: SeSecurityPrivilege	2368	wmic.exe
Token: SeTakeOwnershipPrivilege	2368	wmic.exe
Token: SeLoadDriverPrivilege	2368	wmic.exe
Token: SeSystemProfilePrivilege	2368	wmic.exe
Token: SeSystemtimePrivilege	2368	wmic.exe
Token: SeProfSingleProcessPrivilege	2368	wmic.exe
Token: SeIncBasePriorityPrivilege	2368	wmic.exe
Token: SeCreatePagefilePrivilege	2368	wmic.exe
Token: SeBackupPrivilege	2368	wmic.exe
Token: SeRestorePrivilege	2368	wmic.exe
Token: SeShutdownPrivilege	2368	wmic.exe
Token: SeDebugPrivilege	2368	wmic.exe
Token: SeSystemEnvironmentPrivilege	2368	wmic.exe
Token: SeRemoteShutdownPrivilege	2368	wmic.exe
Token: SeUndockPrivilege	2368	wmic.exe
Token: SeManageVolumePrivilege	2368	wmic.exe
Token: 33	2368	wmic.exe
Token: 34	2368	wmic.exe
Token: 35	2368	wmic.exe
Token: 36	2368	wmic.exe
Token: SeIncreaseQuotaPrivilege	1864	wmic.exe
Token: SeSecurityPrivilege	1864	wmic.exe
Token: SeTakeOwnershipPrivilege	1864	wmic.exe
Token: SeLoadDriverPrivilege	1864	wmic.exe
Token: SeSystemProfilePrivilege	1864	wmic.exe
Token: SeSystemtimePrivilege	1864	wmic.exe
Token: SeProfSingleProcessPrivilege	1864	wmic.exe
Token: SeIncBasePriorityPrivilege	1864	wmic.exe
Token: SeCreatePagefilePrivilege	1864	wmic.exe
Token: SeBackupPrivilege	1864	wmic.exe
Token: SeRestorePrivilege	1864	wmic.exe
Token: SeShutdownPrivilege	1864	wmic.exe
Token: SeDebugPrivilege	1864	wmic.exe
Token: SeSystemEnvironmentPrivilege	1864	wmic.exe
Token: SeRemoteShutdownPrivilege	1864	wmic.exe
Token: SeUndockPrivilege	1864	wmic.exe
Token: SeManageVolumePrivilege	1864	wmic.exe
Token: 33	1864	wmic.exe
Token: 34	1864	wmic.exe
Token: 35	1864	wmic.exe
Token: 36	1864	wmic.exe
Token: SeIncreaseQuotaPrivilege	5004	wmic.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Ranzy_20_11_2020_138KB.exe

description	pid	process	target process
PID 2444 wrote to memory of 4348	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 4348	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 4348	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 2368	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 2368	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 2368	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 1864	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 1864	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 1864	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 5004	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 5004	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 5004	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 4804	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 4804	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe
PID 2444 wrote to memory of 4804	2444	Ranzy_20_11_2020_138KB.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Ranzy_20_11_2020_138KB.exe
"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Ranzy_20_11_2020_138KB.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
PID:4804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-134-0x0000000000000000-mapping.dmp

Download
memory/2368-133-0x0000000000000000-mapping.dmp

Download
memory/4348-132-0x0000000000000000-mapping.dmp

Download
memory/4804-136-0x0000000000000000-mapping.dmp

Download
memory/5004-135-0x0000000000000000-mapping.dmp

Download