Analysis
- max time kernel
192s - max time network
199s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
18/09/2023, 10:11
General
- Target db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785.exe
- Size 228KB
- Sample230918-l71dhsba36
- SHA256 db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785
Malware Config
Extracted
-
C:\Users\Admin\Downloads\How_To_Decrypt_My_Files.txt
-
ragnarok
- #what happend? Unfortunately your files are encrypted, To decrypt your files follow the instructions 1. you need a decrypt tool so that you can decrypt all of your files 2. contact with us for our btc address if you want decrypt your files or you can do nothing just wait your files gona be deleted 3. you can provide a file which size less than 3M for us to prove that we can decrypt your files after you paid 4. it is wise to pay in the first time it wont cause you more losses DEVICE ID: ---------------------------- =AALsMFVPhlVNJFRscjM0M0NFZDO2gzQEVUQBJ0M5YDO3UUQ0YUNEhTODNTMBV0QChTRCJUN3YjM3kzQ0QjQxM0QwMDNEFkREFDRyATN2MTNzIERFNER2gzQ1MDRyM0M4YURzgTQ1I0NFJTOyQzQFZDRDFUQDRkMEF0N2YzQDhzQxMzM1kTR5M0M1YkR4YkRyETQFNzQ5gjQERUN5YjN3ETOFVENDJDRxgTNENTRBdjMFdzNwgzN0kzQzY0NykTO1IzQCdjMBZkQDJkRCljRBFzQxY0NxUkNBFDOxcDRENDOFNjNBVTNGFkQCZDN4UDOCZUQDRDN3QzMBVTR3czN4YEOBVERxQkQ3I0NzIUMFdDNxEDNGRkQFRTQyMkNERDNyETN1UDN3EkNzEUNBVkM5gzN1YzNzQERyUkNwQzM0IjMzETODFzQxYEODFDOCdTOEJEREZUREZjMDFURDZEMCFzQxkzNzEjNxEjQxIjM2QTMCFkN3cTO1MDO4Q0MxYzN0Y0MBFUMFJDR4UENGNTN0MTM5YUN5Y0NCdzQDlDOGJzQwEDOBJTM3EUO4ATQ1kzMFdzQBVkNENjQ2UDRFZTQzYTNDJkQwYjNBNDRChDMyEjM3EUR0ATNDNTN2YTQ3YjN3QjQ1EEOFFENDFURDRERBBTOBRDNyYUN4ETQxYTNFhjM2UkRycjN1YDO4M0NENEOBdjMBN0N5QEMFZDR1EzNGNEO0EUR5IDODRUOERjREhjQDZDNFRENFV0Q1YUM2M0M1ATNDhzMERzQDJkRDBDO2YUMDZERGZjMBJkQxgjN1QDRzEjMFdzMEZkMCdDRFdTMxEkNyczNERERGljQ3E0NwETQCdDN1gjNGBTR2EkRGhjRFhDO1MUM4QkNxgzN4MEOzIDRBBTMFRUN3UjQ3EURFlDRBlDRxgjQBFkQFFTQ5QkRCNDRChzNBVkMyAzMBVDRFRkQGNDOFVjRBlzNFNkM2MkRERkRzUkM0gjMBBjQCRzQEVkNzYkRDVENwcDN0kzQzgTMzU0M1UDR3gzQ2EkNBJ0Q1gzQ5I0M2kTOGZzMCJkMGhTOGJjRwIER1gTNEREOCBzNzU0N4MUOERkNGFkM3ETRyQERGdTNzYkQyQDMDNjQyMEMycjMzIjNBREN5QkN3EkMwkDNyIzMzMjN2IUMzEDOGBTO2MTRBJkQ5gTMzEUNwgTQ4MUOwYDR3kDMzQDO2IDRyYEOCJjQ0kTOxYzN1QUREJUO1ETQyU0Q4QURzQkNGVUQBFEN2kDN5YDRGN0M5YUOFdTRBRzQxQER2ITREF0QxYjQyMjQFFTOxUTQ0QEM3gDO4QUR4gjNEZEMCRkN ---------------------------- you can send your DEVICE ID to mail address below [email protected]
Signatures
- Ragnarok
Ransomware family deployed from Citrix servers infected via CVE-2019-19781.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Renames multiple (419) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 46 IoCs
- Suspicious use of SendNotifyMessage 45 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785.exe"C:\Users\Admin\AppData\Local\Temp\db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c vssadmin delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c netsh advfirewall set allprofiles state off2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How_To_Decrypt_My_Files.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
How_To_Decrypt_My_Files.txt
How_To_Decrypt_My_Files.txt
memory/3228-1178-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1180-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1179-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1184-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1186-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1185-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1187-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1188-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1189-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp
memory/3228-1190-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp