Overview

overview

10

Static

static

3

db8b499d61...85.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    192s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2023, 10:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785.exe

  • Size

    228KB

  • MD5

    e134d5a91ed31516566a091c0caa76fe

  • SHA1

    260c54f8ef9450d2366794f35d0b291bdc133ec5

  • SHA256

    db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785

  • SHA512

    4bccd544d3f53e4240b62651465eee6347cf54501437cf7d6f79060707ba702f4ff16435aeb342099f4b238e7b7372a60a2271b3a9b537e4893d743874c8d1db

  • SSDEEP

    3072:PaOtRGsL8/MmCtAyBsli4bnQC2mCr/yXt5NKMxyNuX987URxf+zgTP7VZKf:PhGsL8kfAyBslvAyd3KMxomvf+iC

Score
10/10
ragnarokevasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\How_To_Decrypt_My_Files.txt

Family

ragnarok

Ransom Note
#what happend? Unfortunately your files are encrypted, To decrypt your files follow the instructions 1. you need a decrypt tool so that you can decrypt all of your files 2. contact with us for our btc address if you want decrypt your files or you can do nothing just wait your files gona be deleted 3. you can provide a file which size less than 3M for us to prove that we can decrypt your files after you paid 4. it is wise to pay in the first time it wont cause you more losses DEVICE ID: ---------------------------- =AALsMFVPhlVNJFRscjM0M0NFZDO2gzQEVUQBJ0M5YDO3UUQ0YUNEhTODNTMBV0QChTRCJUN3YjM3kzQ0QjQxM0QwMDNEFkREFDRyATN2MTNzIERFNER2gzQ1MDRyM0M4YURzgTQ1I0NFJTOyQzQFZDRDFUQDRkMEF0N2YzQDhzQxMzM1kTR5M0M1YkR4YkRyETQFNzQ5gjQERUN5YjN3ETOFVENDJDRxgTNENTRBdjMFdzNwgzN0kzQzY0NykTO1IzQCdjMBZkQDJkRCljRBFzQxY0NxUkNBFDOxcDRENDOFNjNBVTNGFkQCZDN4UDOCZUQDRDN3QzMBVTR3czN4YEOBVERxQkQ3I0NzIUMFdDNxEDNGRkQFRTQyMkNERDNyETN1UDN3EkNzEUNBVkM5gzN1YzNzQERyUkNwQzM0IjMzETODFzQxYEODFDOCdTOEJEREZUREZjMDFURDZEMCFzQxkzNzEjNxEjQxIjM2QTMCFkN3cTO1MDO4Q0MxYzN0Y0MBFUMFJDR4UENGNTN0MTM5YUN5Y0NCdzQDlDOGJzQwEDOBJTM3EUO4ATQ1kzMFdzQBVkNENjQ2UDRFZTQzYTNDJkQwYjNBNDRChDMyEjM3EUR0ATNDNTN2YTQ3YjN3QjQ1EEOFFENDFURDRERBBTOBRDNyYUN4ETQxYTNFhjM2UkRycjN1YDO4M0NENEOBdjMBN0N5QEMFZDR1EzNGNEO0EUR5IDODRUOERjREhjQDZDNFRENFV0Q1YUM2M0M1ATNDhzMERzQDJkRDBDO2YUMDZERGZjMBJkQxgjN1QDRzEjMFdzMEZkMCdDRFdTMxEkNyczNERERGljQ3E0NwETQCdDN1gjNGBTR2EkRGhjRFhDO1MUM4QkNxgzN4MEOzIDRBBTMFRUN3UjQ3EURFlDRBlDRxgjQBFkQFFTQ5QkRCNDRChzNBVkMyAzMBVDRFRkQGNDOFVjRBlzNFNkM2MkRERkRzUkM0gjMBBjQCRzQEVkNzYkRDVENwcDN0kzQzgTMzU0M1UDR3gzQ2EkNBJ0Q1gzQ5I0M2kTOGZzMCJkMGhTOGJjRwIER1gTNEREOCBzNzU0N4MUOERkNGFkM3ETRyQERGdTNzYkQyQDMDNjQyMEMycjMzIjNBREN5QkN3EkMwkDNyIzMzMjN2IUMzEDOGBTO2MTRBJkQ5gTMzEUNwgTQ4MUOwYDR3kDMzQDO2IDRyYEOCJjQ0kTOxYzN1QUREJUO1ETQyU0Q4QURzQkNGVUQBFEN2kDN5YDRGN0M5YUOFdTRBRzQxQER2ITREF0QxYjQyMjQFFTOxUTQ0QEM3gDO4QUR4gjNEZEMCRkN ---------------------------- you can send your DEVICE ID to mail address below [email protected]

Signatures

  • Ragnarok

    Ransomware family deployed from Citrix servers infected via CVE-2019-19781.

    ransomwareragnarok
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (419) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785.exe
    "C:\Users\Admin\AppData\Local\Temp\db8b499d613b604a439bca37c3be2f578bdfcde1b2271eccbcf22db85996e785.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2216
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3700
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c bcdedit /set {current} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4048
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c netsh advfirewall set allprofiles state off
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4388
      • C:\Windows\system32\netsh.exe
        netsh advfirewall set allprofiles state off
        3⤵
        • Modifies Windows Firewall
        PID:3232
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1448
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3308
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:772
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How_To_Decrypt_My_Files.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4800
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5100
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\How_To_Decrypt_My_Files.txt
      Filesize

      1KB

      MD5

      a205b37f43b175c09668ab05844fbd6c

      SHA1

      153aaa5b7c37e105bfde44c0878bc159cf641233

      SHA256

      0fc5a22b01227af15f8d7f4885412b51567954120fc2193218f76f21fc79d3b2

      SHA512

      5713158751a48f84333689c7b8e81637f3f5a49704f4fa0b167bc2e5794210a0a0f5a90a612f5817380af5279366caa70ec43809f2a47b89cb07909ad42b8ca6

      Download Submit

    • C:\Users\Admin\Downloads\How_To_Decrypt_My_Files.txt
      Filesize

      1KB

      MD5

      a205b37f43b175c09668ab05844fbd6c

      SHA1

      153aaa5b7c37e105bfde44c0878bc159cf641233

      SHA256

      0fc5a22b01227af15f8d7f4885412b51567954120fc2193218f76f21fc79d3b2

      SHA512

      5713158751a48f84333689c7b8e81637f3f5a49704f4fa0b167bc2e5794210a0a0f5a90a612f5817380af5279366caa70ec43809f2a47b89cb07909ad42b8ca6

      Download Submit

    • memory/3228-1178-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1180-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1179-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1184-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1186-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1185-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1187-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1188-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1189-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3228-1190-0x0000026C6FE30000-0x0000026C6FE31000-memory.dmp

      Filesize

      4KB

      Download