Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2023 09:38

General

  • Target

    6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe

  • Size

    84KB

  • MD5

    2a887c67f2a42c906d5216027f3af000

  • SHA1

    b6e14c4f157eda1267252c89440a3be446c47fb0

  • SHA256

    6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576

  • SHA512

    13fbe2dfeca5a3299f49dc9ec9663a50c33733d1f2fd653f75129b286c4e1b2bffa22d3e8c3d29fdc3ccb534b2ed9a27e006460c5a1336e1fcc87560dbc578b0

  • SSDEEP

    1536:q+PMmEiQ2037WAX2xKGr0Utv4JQqJvZ9LrKZNy8UMhLq:MmEP2037WfxRIxiy8hL

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming!_^_RAGNAR_README_NOTES_^_!.txt

Ransom Note
******************************************************************************************************************* HELLO Mayanei Hayeshua Medical Center ! If you reading this message, it means your network was PENETRATED and all your files has been ENCRYPTED ------------------------------------------------- | | | by R A G N A R L O C K E R ! | | | ------------------------------------------------- ******************************************************************************************************************** [ YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL ] (contact information you will find at the bottom of this notes) **** WARNING **** DO NOT Hire any THIRD-PARTY NEGOTIATORS (RECOVERY Groups/FBI/Police and etc), otherwise we will close chat immediately and Publish all your Data. DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files. --------------------------------------------------------------------------------------------------------------------------------------- ----[WHAT'S HAPPENED] Your security perimeter was BREACHED. Your critically important servers and hosts wasn't encrypted only to avoid any harm to your patients. However, if you will ignore this issue - we can use our backdoors and come back. This README-FILE here for you to show you our presence in your's network and avoid any silence about hacking and leakage. Also, we has DOWNLOADED about 1TB of your CONFIDENTIAL and most SENSITIVE Data, including your SQL DATABASE just in case if you will NOT PAY, than everything will be PUBLISHED in Media and/or SOLD to any third-party. WE HAS COLLECTED SUCH DATA AS: - Medicine cards, accident reports, patients private medical information, surgery and drugs prescription, dignoses - and other documents that could be made freely available for public use - Employees and Patients personal information including: Address and contacts, ID scans, Social numbers, payments - for which your company is sure to receive angry claims and class action lawsuits - Confidential internal correspondence, Finances, Emails, Passwords, Credentials, SQL Databases - all such info can be sold to a third parties and this will initiate more attacks by different kind of fraudsters or hackers. ----[WHAT SHOULD YOU DO] - You have to contact us as soon as possible (you can find contacts below) - You should purchase our decryption tool, then you will be able to restore your files. Without our Decryption keys it's impossible - You should make a Deal with us, to avoid your Sensitive Data leaks - You should stay away from any third-parties recovery soft, since it could damage files - You should avoid any scammers using our name in different communication ways. We communicate only via LIVE CHAT - You should avoid any third-party negotiators and recovery groups ----[YOUR OPTIONS] 1) IF NO CONTACT OR DEAL MADE IN 3 DAYS: Decryption key will be deleted permanently and recovery will be impossible. All your Data will be Published and/or Sold to any third-parties Information regarding vulnerabilities of your network also can be published and/or shared Such Leakage will have disastrous consequences to your business reputation. 2) If WE MAKE A DEAL: We will provide you with the Decryption Key and Manual how-to-use. We will remove all your files from our file-storage with proof of Deletion We will delete posts with your company name We guarantee to avoid sharing any details with third-parties We will provide you the penetration report and list of security-recommendations [Here are couple of screenshots just as a proofs of Data possession, you can find more in our Leak Blog] Screenshots: https://prnt.sc/gDHQXaqtj-cH https://prnt.sc/AUfqF2QJFdn1 https://prnt.sc/GAhNZAqqKlrN https://prnt.sc/amTTYUUsTIkP https://prnt.sc/vv-YFugZ9sXn https://prnt.sc/MyoJatQTPhpF https://prnt.sc/IZj1l46cnKqi ------------------------------------------------------------------------------------------------------------- LEAK BLOG ACCESS: We will provide you with the link for private Temporary leak page with some more proofs of data possession ====================================================================== [ HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ] !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Download and install TOR browser from this site : https://torproject.org 2) For contact us via LIVE CHAT open our website : http://ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion/client/?MYMC_213a_155_2023_07_08 3) To visit TEMPORARY LEAK PAGE with your data on our Leaks Blog - please request the link in Live-Chat 4) If Tor is restricted in your area, use VPN 5) All your Data will be published in 3(three) Days if NO contact made 6) Your Decryption keys will be permanently destroyed in 3(three) D
URLs

https://prnt.sc/gDHQXaqtj-cH

https://prnt.sc/AUfqF2QJFdn1

https://prnt.sc/GAhNZAqqKlrN

https://prnt.sc/amTTYUUsTIkP

https://prnt.sc/vv-YFugZ9sXn

https://prnt.sc/MyoJatQTPhpF

https://prnt.sc/IZj1l46cnKqi

http://ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion/client/?MYMC_213a_155_2023_07_08

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 20 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies Control Panel 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe
    "C:\Users\Admin\AppData\Local\Temp\6fdd56465a950f36490c47caa3aaffa93bafa2a2f09a5e4e16bc09918bf5c576.exe"
    1⤵
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    PID:2472

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming!_^_RAGNAR_README_NOTES_^_!.txt
    Filesize

    5KB

    MD5

    7d6025dea012fadbd8c8fb55c6fa17cb

    SHA1

    fc10a7fb76c3ac60977689a848e5e696eba752af

    SHA256

    c3d16293f7f0ac185eb458baea7decae7c23c1b1277c115ba0043558eaca40bc

    SHA512

    505707cb9e0e88c314bfceefb814dffa2398077763fbf7972745dd8af7f033df8a94cd6190cc76fd295f9ea26d29ddc74f61b231a53f9cdf5239b84a6d1b7863