Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 09:38
Static task
static1
Behavioral task
behavioral1
Sample
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe
Resource
win10v2004-20230915-en
General
-
Target
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe
-
Size
84KB
-
MD5
2a887c67f2a42c906d5216027f3af000
-
SHA1
b6e14c4f157eda1267252c89440a3be446c47fb0
-
SHA256
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576
-
SHA512
13fbe2dfeca5a3299f49dc9ec9663a50c33733d1f2fd653f75129b286c4e1b2bffa22d3e8c3d29fdc3ccb534b2ed9a27e006460c5a1336e1fcc87560dbc578b0
-
SSDEEP
1536:q+PMmEiQ2037WAX2xKGr0Utv4JQqJvZ9LrKZNy8UMhLq:MmEP2037WfxRIxiy8hL
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming!_^_RAGNAR_README_NOTES_^_!.txt
https://prnt.sc/gDHQXaqtj-cH
https://prnt.sc/AUfqF2QJFdn1
https://prnt.sc/GAhNZAqqKlrN
https://prnt.sc/amTTYUUsTIkP
https://prnt.sc/vv-YFugZ9sXn
https://prnt.sc/MyoJatQTPhpF
https://prnt.sc/IZj1l46cnKqi
http://ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion/client/?MYMC_213a_155_2023_07_08
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 20 IoCs
Processes:
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\00009.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00011.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00012.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00019.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00021.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00005.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00020.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00004.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00006.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00007.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00008.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00013.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00014.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00003.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00015.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00016.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00017.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00018.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Windows\system32\spool\PRINTERS\00010.SPL 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\RoamingR_Desk.jpg" 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exedescription ioc process File created C:\Program Files (x86)\Common Files\Adobe AIR\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Microsoft Games\Solitaire\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Microsoft Games\FreeCell\es-ES\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Microsoft Games\Mahjong\fr-FR\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Media Player\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Windows Media Player\Skins\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Common Files\Microsoft Shared\TextConv\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft Analysis Services\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Common Files\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Microsoft.NET\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Java\jre7\lib\images\cursors\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe File created C:\Program Files\VideoLAN\VLC\locale\be\!_^_RAGNAR_README_NOTES_^_!.txt 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe -
Modifies Control Panel 2 IoCs
Processes:
6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Control Panel\Desktop\TileWallpaper = "0" 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Control Panel\Desktop\WallpaperStyle = "2" 6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe"C:\Users\Admin\AppData\Local\Temp\6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe"1⤵
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies Control Panel
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming!_^_RAGNAR_README_NOTES_^_!.txtFilesize
5KB
MD57d6025dea012fadbd8c8fb55c6fa17cb
SHA1fc10a7fb76c3ac60977689a848e5e696eba752af
SHA256c3d16293f7f0ac185eb458baea7decae7c23c1b1277c115ba0043558eaca40bc
SHA512505707cb9e0e88c314bfceefb814dffa2398077763fbf7972745dd8af7f033df8a94cd6190cc76fd295f9ea26d29ddc74f61b231a53f9cdf5239b84a6d1b7863