Overview

overview

10

Static

static

3b43751ed8...04.exe

windows7-x64

10

3b43751ed8...04.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    78s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 21:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b43751ed88e4d1f82cf52ca2d4477e3e35c35f08c1b4e3ab21c80720601e804.exe

  • Size

    54KB

  • MD5

    439ef1ddf569a7d6a8280a229357fcfc

  • SHA1

    c1a5dfd851337cd12770244c97e83b7066dea781

  • SHA256

    3b43751ed88e4d1f82cf52ca2d4477e3e35c35f08c1b4e3ab21c80720601e804

  • SHA512

    fe4c2a55135f065af8733a1eeb9904353b7279f44ecb8732c58067d4b15f03c5c15d10857994943e785c35a688ca2ee9f333abf3a6dca80542d651be6b77e75e

  • SSDEEP

    768:gDq17yBfcKW/engJIYVQIz2yNVn/+Q7tXZ70OSWas5Y:MqM6/OgS4Qs3F7tJ7nSW55

Score
10/10
ragnarlockerbootkitevasionpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\!$R4GN4R_77206419$!.txt

Family

ragnarlocker

Ransom Note
***************************************************************************************************************** HELLO mapfree.com ! IF YOU ARE READING THIS, IT'S MEAN YOUR DATA WAS ENCRYPTED AND YOU SENSITIVE PRIVATE INFORMATION WAS STOLEN! READ CAREFULLY THE WHOLE INSTRUCTION NOTES TO AVOID DIFFICULTIES WITH YOUR DATA by RAGNAR_LOCKER ! ***************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files ------------------------------------- There is ONLY ONE possible way to get back your files - contact us via LIVE CHAT and pay for the special DECRYPTION KEY ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, to show that it Works. Don't waste your TIME, the link for contact us will be deleted if there is no contact made in closest time and you will NEVER restore your DATA. !!! HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ! WARNING ! Whole your network was fully COMPROMISED! We BREACHED your security perimeter and get ACCESS to your PRIVATE SENSITIVE Data, including your Insuranse cases, Financial reports, Business audit reports, Non-Disclosure Agreements, Confidential files, DataBase files, Administrators directories and etc.! Also we have access to corporate correspondence, personal information about your clients and even more about your partners and your staff. - There are some screenshots just as a proofs of what we got on you. Screenshots: http://prnt.sc/tz6u6u http://prnt.sc/tz6uq9 http://prnt.sc/tz6uz9 http://prnt.sc/tz6w7x http://prnt.sc/tzoumv ------------------------------------- Whole data that gathered from your private files and directories could be published in MASS MEDIA for BREAKING NEWS! Yours partners, clients and investors would be notified about LEAK, the consequences will have a DISASTROUS effect on your company's STOCK PRICES! However if we make a deal everything would be kept in secret and all your data will be restored, so it is much cheaper and easier way than lawsuits expenses for you. You can take a look for some more examples of what we have, right now it's a private, temporary and hidden page, but it could become permanent and accessable for Public View if you decide NOT pay. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/?J0gYIisP3R7m to view the page's content use password: mNn36C6GOf ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?E5AddcB5e33bF83b3e3e23ef7fD9Dc28eAe4CA0f2D0992AC4d688A35eB5c543F c) To visit our NEWS LEAK BLOG with your data, open this website : http://p6o7m73ujalhgkiv.onion/?J0gYIisP3R7m ( password: mNn36C6GOf ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN KEY R_R--- RTVBZGRjQjVlMzNiRjgzYjNlM2UyM2VmN2ZEOURjMjhlQWU0Q0EwZjJEMDk5MkFDNGQ2ODhBMzVlQjVjNTQzRg== ---END KEY R_R--- ***********************************************************************************
URLs

http://prnt.sc/tz6u6u

http://prnt.sc/tz6uq9

http://prnt.sc/tz6uz9

http://prnt.sc/tz6w7x

http://prnt.sc/tzoumv

http://p6o7m73ujalhgkiv.onion/?J0gYIisP3R7m

http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?E5AddcB5e33bF83b3e3e23ef7fD9Dc28eAe4CA0f2D0992AC4d688A35eB5c543F

Signatures

  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    ransomwareragnarlocker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
    ransomwareevasion
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b43751ed88e4d1f82cf52ca2d4477e3e35c35f08c1b4e3ab21c80720601e804.exe
    "C:\Users\Admin\AppData\Local\Temp\3b43751ed88e4d1f82cf52ca2d4477e3e35c35f08c1b4e3ab21c80720601e804.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3692
    • C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:4712
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4388
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:1772
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {globalsettings} advancedoptions false
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4604
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads