phobos | 7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2023 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ragnarok.exe
Size

56KB
MD5

9eafe0c48ea68ccb1da722b5bc36fa8c
SHA1

d598a96f482c4e5412baf5723b5a53f5930f0126
SHA256

7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7e
SHA512

73f8835c487fb0007775a5696b41369721da150b6e8aa1b442d5b9bab6c46255c4d0ef9c5e1ea1c0547586866d026a9006a2d5c39e8a42afe634cb9c67512a75
SSDEEP

768:NvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1E3WUrXzM+W5I+:vNeRBl5PT/rx1mzwRMSTdLpJ3o2zEt

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1820 bcdedit.exe
4100 bcdedit.exe
Renames multiple (339) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2876 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

4700 netsh.exe
3892 netsh.exe
Drops startup file 1 IoCs

Processes:

ragnarok.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ragnarok.exe ragnarok.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1820	bcdedit.exe
4100	bcdedit.exe

pid	process
2876	wbadmin.exe

pid	process
4700	netsh.exe
3892	netsh.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\ragnarok.exe	ragnarok.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ragnarok.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ragnarok = "C:\\Users\\Admin\\AppData\\Local\\ragnarok.exe"	ragnarok.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ragnarok = "C:\\Users\\Admin\\AppData\\Local\\ragnarok.exe"	ragnarok.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

ragnarok.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini	ragnarok.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1045988481-1457812719-2617974652-1000\desktop.ini	ragnarok.exe
File opened for modification	C:\Program Files\desktop.ini	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ragnarok.exe

Drops file in Program Files directory 64 IoCs

Processes:

ragnarok.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	ragnarok.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FPLACE.DLL	ragnarok.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\security\java.security.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PROFILE.INF	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\vreg\proof.es-es.msi.16.es-es.vreg.dat.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	ragnarok.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx	ragnarok.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak	ragnarok.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF	ragnarok.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\AXIS.ELM	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\STRTEDGE.ELM	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SignalRClient.dll	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sybase.xsl	ragnarok.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\PREVIEW.GIF	ragnarok.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\accessibility.properties.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ragnarok.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui	ragnarok.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_FR.LEX	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml	ragnarok.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	ragnarok.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[2C0A8644-3404].[[email protected]].Elbie	ragnarok.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2208 vssadmin.exe

pid	process
2208	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ragnarok.exe

pid	process
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe
4088	ragnarok.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

ragnarok.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeDebugPrivilege	4088	ragnarok.exe
Token: SeBackupPrivilege	1720	vssvc.exe
Token: SeRestorePrivilege	1720	vssvc.exe
Token: SeAuditPrivilege	1720	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe
Token: 36	1588	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe
Token: 36	1588	WMIC.exe
Token: SeBackupPrivilege	4320	wbengine.exe
Token: SeRestorePrivilege	4320	wbengine.exe
Token: SeSecurityPrivilege	4320	wbengine.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

ragnarok.execmd.execmd.exe

description	pid	process	target process
PID 4088 wrote to memory of 4344	4088	ragnarok.exe	cmd.exe
PID 4088 wrote to memory of 4344	4088	ragnarok.exe	cmd.exe
PID 4088 wrote to memory of 1068	4088	ragnarok.exe	cmd.exe
PID 4088 wrote to memory of 1068	4088	ragnarok.exe	cmd.exe
PID 4344 wrote to memory of 4700	4344	cmd.exe	netsh.exe
PID 4344 wrote to memory of 4700	4344	cmd.exe	netsh.exe
PID 1068 wrote to memory of 2208	1068	cmd.exe	vssadmin.exe
PID 1068 wrote to memory of 2208	1068	cmd.exe	vssadmin.exe
PID 4344 wrote to memory of 3892	4344	cmd.exe	netsh.exe
PID 4344 wrote to memory of 3892	4344	cmd.exe	netsh.exe
PID 1068 wrote to memory of 1588	1068	cmd.exe	WMIC.exe
PID 1068 wrote to memory of 1588	1068	cmd.exe	WMIC.exe
PID 1068 wrote to memory of 1820	1068	cmd.exe	bcdedit.exe
PID 1068 wrote to memory of 1820	1068	cmd.exe	bcdedit.exe
PID 1068 wrote to memory of 4100	1068	cmd.exe	bcdedit.exe
PID 1068 wrote to memory of 4100	1068	cmd.exe	bcdedit.exe
PID 1068 wrote to memory of 2876	1068	cmd.exe	wbadmin.exe
PID 1068 wrote to memory of 2876	1068	cmd.exe	wbadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ragnarok.exe
"C:\Users\Admin\AppData\Local\Temp\ragnarok.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Local\Temp\ragnarok.exe
"C:\Users\Admin\AppData\Local\Temp\ragnarok.exe"
2⤵
PID:2796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4344

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
- Modifies Windows Firewall
PID:4700

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
- Modifies Windows Firewall
PID:3892

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2208

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:1820

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:4100

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:2876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
49KB

MD5
2f244a56091c9705794e92e6bcc38058

SHA1
3f2b518be764f29c66ba8564d1be8f4309cce747

SHA256
e322feefa8d4c76d8749f88c9b877e3e119418c4ac0b18a8cfb7260638cc588d

SHA512
3ee3835abfec9c2db4ba1f33b5e59db2400e712d5dd7cde82a12889ea1beab8ac85b923ec0447e81b3d2ce3ebd14922882653f5bcdcc81a29f225acfa4872572

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
57B

MD5
ab9d8ef2ffa9145d6c325cefa41d5d4e

SHA1
0f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab

SHA256
65a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785

SHA512
904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png

Filesize
138B

MD5
a2bb242dc046bacdc58e7fbbe03cce85

SHA1
052ab788f1646b958e0ea2c0ef47d00141fc1004

SHA256
486a8212c0d6860840d883981ca52daaad3bf3b2ab5be56cdc47ed9b42daba22

SHA512
d9bb4c0658f79fbcf22697c24bc32f4ef27ddf934e8f41cf73a2990d18cdb38379f6b61e50edef8ebdf5a2f59a0f8fa40e000b24f1c55a06cfa161db658326ad

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml

Filesize
431B

MD5
2c16868331f82ff43059dcb0ea178af3

SHA1
983589535e05c495ffeae4b0b31ddcfafe92a763

SHA256
be9ceb4464b22203feffd3700c5570b7d6d44c5d0d357148e1e6d5be5e694376

SHA512
184653d3e40df84cd0052e5d9477201f276ce0e8cbb5e4b7bfac86fc7da325eef476982910be24c20725a6db6617fffd88998d6053c1b694718bc7ab0bde9ea1

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-windows.xml

Filesize
411B

MD5
f7c78514872f9cb5585f8d69532cd2d0

SHA1
ff9dfbb62a3b48c85b6434ee831fb33a8dba9526

SHA256
5f7bcd85900e62abb00ce739eaad53d80170a4a6152d951b6825110d2fc17965

SHA512
50ee6ae916ea0e806b73c2e5bb727f6ee4837a696c5bd8559ede78148b40a5d5cdd135e28c8b5153a8fef568fd21ef0708ca198ace89e7120ffb84fd9bc91c01

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml

Filesize
429B

MD5
d7d2fed9b7c55fe72a6cda66725cb7e8

SHA1
2cb154a1c4a0553658801a088edf87b5816cbbd2

SHA256
a6df5cb2b51fa56609c7daf08d28f0e41801b96f9514a9d179992a63afd516b5

SHA512
0ba4d570d624cc5aa6af629260668ad805285fcedd61002999734fe04cae47016cf52022c327cf22935ded99b30c52d9f041ead60a3425365116bf1bf4cbcf5e

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml

Filesize
400B

MD5
a75d7d422fd00bf31208b013e74d8394

SHA1
3d59f8de55a42cc13fb2ebda6de3a5193f2ee561

SHA256
7a12e561363385e9dfeeab326368731c030ed4b374e7f5897ac819159d2884c5

SHA512
af3a1e15594a0bf08ae34a5948037ef492e71ee33d5d4ac9f24b18adf99a34563ab40ba8f47f2adff5d928f18d8a8cd60fc78e654e4d6cf962292d2f606def66

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml

Filesize
437B

MD5
ceb1e6764a28b208d51a7801052118d7

SHA1
2719eea8bde44ff35dd7b274df167c103483b895

SHA256
99d48b66d590c07b14f4cd68adac79e92616afcf00503a846b6bf4599bfeabc0

SHA512
f4a2df6229bca6c6ef9ef9f432847683238715eddcb1f89c291da5f5900c9a3461204d8495c3450c8bae1c1a661424089554d316468ba1b039a2c50d6e69bf29

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml

Filesize
463B

MD5
48e296d8287ae11c252e4277ee885161

SHA1
8a75b573549c2791d38acb3a4d215fa2153b37eb

SHA256
c94a9a55369ccc4b41a71b9c18b04e1778a0913447ca6b5a630135f7a7ac0c1b

SHA512
b17a5a8a6009bfde681829bd7be3b550d8b8bf6bfee19bdd55567163890550980ac0633fd956f117006892638f408c63449d4520b0716e6866ab0858cc3f743b

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml

Filesize
473B

MD5
437687da72730cf42ce36bd093b78b3e

SHA1
693e31dc362426bc4d7a6b2954f7c80267476d66

SHA256
d0d0b1face19fe4a88c6b51f6ced55ae0e00ac548b75809d88089ad431da5d3a

SHA512
7d05e270926dcb452ce405dac9dab6e9e1a0dd247bc93f0940826eb4abecf827acb6f42ef32d3b6f6ac4b46b28d522e0b25f6b8b679affb9a198db8ba4fe2daa

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml

Filesize
417B

MD5
9f89b49e6e4b81eb9a3ef6a5d8924461

SHA1
17ee8eae11a1fb327f3344cc549bef305de408c5

SHA256
d739aa103e35aa5efd0fe49dd14d9360b5a83261b164d6d3277a24fed97ff8fc

SHA512
ef2f26b00ee4dccdb28fc1bb6c960cab9ae6f72f126bee21104b865b8e7833b35a64abf464b71cc34e954a8ccdb805544729368caee2a84b8ab97914c30fa761

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml

Filesize
405B

MD5
bb95a9de280c528c32806d0d5231de6d

SHA1
bbffb8596f1bc68df5603a10a3672a02ebd3ea8b

SHA256
a7ca0125b93e1a5681d5a9c294ec3a4e5680cc58e44fd223d2dac04232b7367c

SHA512
ac4cad4f24495aa6b0d5ed8aa439554f479cc2fdba4d5dd256f1983fa43a4121c8fdf79ad7ec9d9a396a73fd480bf2f5141ab5303d50c8b6d2ce47d158010a80

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml

Filesize
407B

MD5
0188bed9647ab3c0f81dc3e4b5589baa

SHA1
05493cad7050ee0cba5255847941736898503dd3

SHA256
f5d3f822a8435f91f7a5d54b720aa637f8b8f8102c7670d1b52d98f2d0123beb

SHA512
20e40619e02c24acd461fe07a7d7e448bdd03f423221ecde05ec206eb7b520d3d500e3b5988122b97a8752fe2cc7b305417692ec73d4568dcf49b2c3c4fb8d0b

Download Submit
C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\invalid32x32.gif

Filesize
153B

MD5
d13b5ffdeb538f15ee1d30f2788601d5

SHA1
8dc4da8e4efca07472b08b618bc059dcbfd03efa

SHA256
f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876

SHA512
58e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46

Download Submit
C:\Program Files\Java\jre1.8.0_66\release

Filesize
527B

MD5
ff9a2d3be0b1b401f5bbae30ab62a24d

SHA1
29d8cda271ced9cf1d430029fa4ab0d6ba5948c0

SHA256
fd13695474bc8227057e56cb7013cea630c9ad3a2a134b7b412293f850c1df43

SHA512
0dd906600b44350136079b23488fd72b0f1a8a4eed594b26a692a725a62a741707b2811005dc11a389e5da89ebfd7040519342813035047bbee906a20beff2e1

Download Submit
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml

Filesize
1KB

MD5
0b783b2c6d8aa254f3e90187725263aa

SHA1
df2e49e32c8e1d25b17d410addf35badc22ef90f

SHA256
590de671f8b144c3ec28a4e953a91685bb6c2a97c7c25c08d44003445bc2fe3e

SHA512
ef532a7213505f49d95b05cf27d64e1b45ef9ded6b057ba0501fb0b62631784f21f235a0842c58b2b27522e06bb383afefd3220c85064b729b45131692fa2461

Download Submit
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml

Filesize
744B

MD5
809457c05fe696f5d34ac5ac8768cdd4

SHA1
a2c3e4966415100c7d24f7f3dc7e27d2a60d20c9

SHA256
1b66520d471367f736d50c070a2e2bba8ad88ac58743394a764b888e9cb6f6be

SHA512
cf38e01d3e174ff4b8070fb88ead7e787143ce7cf60b91365fafd01cacc1420337654083a14dfb2caa900141a578717f5d24fa3cadd17c1a992d09280fd8dc44

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
c183857770364b05c2011bdebb914ed3

SHA1
040e5ac904de86328cca053a15596e118fc5da24

SHA256
094c4931fdb2f2af417c9e0322a9716006e8211fe9017f671ac6e3251300acca

SHA512
8ac7790c0687f86d2d0ca82cfc9921c8cd6e6f5392594317d5ee6f3661500de58ebd5ef6300a412c23ed1cd2748c5eadeeb9719f32758590bd4168a0259bbd70

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK

Filesize
114B

MD5
301657e2669b4c76979a15f801cc2adf

SHA1
f7430efc590e79b847ab97b6e429cd07ef886726

SHA256
802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b

SHA512
e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK

Filesize
113B

MD5
b9205d5c0a413e022f6c36d4bdfa0750

SHA1
f16acd929b52b77b7dad02dbceff25992f4ba95e

SHA256
951b1c95584b91fd8776e1d26b25d745ad5d508f6337686b9f7131d7c2f7096a

SHA512
0e67910bcf0f9ccde5464c63b9c850a12a759227d16b040d98986d54253f9f34322318e56b8feb86c5fb2270ed87f31252f7f68493ee759743909bd75e4bb544

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\CANYON.INF

Filesize
465B

MD5
a1534d6e98a6b21386456a8f66c55260

SHA1
c7239c0fe3b7a00d812e548f4cb9d8d863e8c251

SHA256
4c555a3d8b83f80c2e0d0b647769e82148ebe7e27811d0a63277d6f61abafbbc

SHA512
af0302203a3ccb765aa4ce1b1ab524ffa500d62e179ffb527b76d2b62f5ba31b037902d8d46278378e7255a91251f06c0779fe4940d47a582415a201b0e401db

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF

Filesize
1KB

MD5
80e4b616b1c7264011924f980d0a1d5e

SHA1
d2811ba0bae94849d9a97e1f8ce89af91da2db9b

SHA256
e8eac758147eeb2b17f4c1e59ab9fc9bd1cb6c764665e0b028700ac7a4744a5b

SHA512
5943d1d5a6c50ca451cfdc46284aebe563bab24646e7ee5854da2f0f617a15a56f2686c766be7eb605e6952fdf9a49e2794ef07e29bac64a59a471ce40066eec

Download Submit
C:\Program Files\Mozilla Firefox\xul.dll.sig

Filesize
1KB

MD5
69016e6a597d194701476b8e04d4e028

SHA1
71a24ddb0c5bbd321d3f09d7b322c3655fb5e129

SHA256
4740d289d0a31bc1fc00e255845b3d8ba7cec2d6d0ee92177d23aa293f9fca3a

SHA512
a9399ea57f65c6569e2a9e9ebe9fa2da7184ec92a555549f39cbbe9dff15530ad526107a2a2304d822be37580a965c6ea4e88a46adebd8ff3af402d2c25321ae

Download Submit
C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo

Filesize
467B

MD5
cafc2a2dde2f05e2a60677690d2ca245

SHA1
8bd9c447b79435b8497212ef76f5b43dffb030a8

SHA256
db91bef58cfa8c3ad4587f4d737202a2ea4374deb35305e8e56a4e0b57232a7e

SHA512
7f293929a1147163d71c612084c7fb99740a1fdae3a3f9d7782f795c10c1b7b2e49617e9d6746938167a2dd49bc5c53788bd8751c61ad145d2d42700ae1f1575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Filesize
24B

MD5
1681ffc6e046c7af98c9e6c232a3fe0a

SHA1
d3399b7262fb56cb9ed053d68db9291c410839c4

SHA256
9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

SHA512
11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

Download Submit