Overview

overview

10

Static

static

7

04c9cc0d15...87.exe

windows7-x64

10

04c9cc0d15...87.exe

windows10-2004-x64

Analysis

  • max time kernel
    32s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28-12-2023 10:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87.exe

  • Size

    27KB

  • MD5

    682ce5d86e8181d1e0a18780a5b158df

  • SHA1

    ee4b692b3beea8e0a4cd972ad4dba4595fdf4fb4

  • SHA256

    9dbcee8b0f17203c0b122b582b37c72a518536878120f5b7878651da6da37c10

  • SHA512

    5f21ed3b15cb6cde5dc137ac39b1400982aebdde9e3d8fe349b74fd9ba1f39a22d9bab166f0c606f290d86c3d578df8e086af567ec1bf79edd4bf59bfd9c9294

  • SSDEEP

    384:dsRKN4ZYmcv/rELdMF2CC5hAkjz0pFOvcZsIw6THPOt5l3AyJuB1uTSqv:duZYpYMQCC/xcOvcKDGu5Je1YSq

Score
10/10
ragnarlockerbootkitevasionpersistenceransomwareupx

Malware Config

Extracted

Path

C:\Users\Public\Documents\!$R4GN4R_66A976E8$!.txt

Family

ragnarlocker

Ransom Note
***************************************************************************************************************** HELLO CWT_company ! IF YOU ARE READING THIS, IT'S MEAN YOUR DATA WAS ENCRYPTED AND YOU SENSITIVE PRIVATE INFORMATION WAS STOLEN! READ CAREFULLY THE WHOLE INSTRUCTION NOTES TO AVOID DIFFICULTIES WITH YOUR DATA by RAGNAR_LOCKER ! ***************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for the special DECRYPTION KEY ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof that it Works. Don't waste your TIME, the link for contact us will be deleted if there is no contact made in closest time and you will NEVER restore your DATA. !!! HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ! WARNING ! Whole your network was fully COMPROMISED! We has DOWNLOADED more than 2 TB of your PRIVATE SENSITIVE Data, including your Billing info, Insuranse cases, Financial reports, Business audit, Banking Accounts! Also we have corporate correspondence, information about your clients such as AXA Equitable, Abbot Laboratories, AIG, Amazon, Boston Scientific, Facebook, J & J, SONOCO, Estee Lauder and many others. We got even more info about your partners and even about your staff, there are some screenshots just as a proofs of what we got on you. Screenshots: http://prntscr.com/to31n0 (from here was downloaded almost every file) https://prnt.sc/to2kqq https://prnt.sc/to2lbp https://prnt.sc/tnzooz your trial balances in USD https://prnt.sc/tnzqxf https://prnt.sc/to2qlx http://prnt.sc/to2rab ------------------------------------- Whole data that gathered from your private files and directories could be published in MASS MEDIA for BREAKING NEWS! Yours partners, clients and investors would be notified about LEAK. However if we make a deal everything would be kept in secret and all your data will be restored. You can take a look for some more examples of what we have, right now it's a private hidden page, but it could become accessable for Public View if you decide NOT pay. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/?BatxqaHm8rKxIP16Z1xB to view the page's content use password: GME5sYUN0A ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?bC2aAD71E2976da53FC1Efc3193c8FDeA0BAeF8A37883c9e05d3BFF82CCfE8Ee c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/?BatxqaHm8rKxIP16Z1xB ( password: GME5sYUN0A ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN KEY R_R--- YkMyYUFENzFFMjk3NmRhNTNGQzFFZmMzMTkzYzhGRGVBMEJBZUY4QTM3ODgzYzllMDVkM0JGRjgyQ0NmRThFZQ== ---END KEY R_R--- ***********************************************************************************
URLs

http://prntscr.com/to31n0

https://prnt.sc/to2kqq

https://prnt.sc/to2lbp

https://prnt.sc/tnzooz

https://prnt.sc/tnzqxf

https://prnt.sc/to2qlx

http://prnt.sc/to2rab

http://p6o7m73ujalhgkiv.onion/?BatxqaHm8rKxIP16Z1xB

http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?bC2aAD71E2976da53FC1Efc3193c8FDeA0BAeF8A37883c9e05d3BFF82CCfE8Ee

Signatures

  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    ransomwareragnarlocker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
    ransomwareevasion
  • Renames multiple (105) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87.exe
    "C:\Users\Admin\AppData\Local\Temp\04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:2816
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {globalsettings} advancedoptions false
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2584
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:1648
    • C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:1728
    • C:\Windows\SysWOW64\notepad.exe
      C:\Users\Public\Documents\!$R4GN4R_66A976E8$!.txt
      2⤵
        PID:2540
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2636

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Privilege Escalation

    Defense Evasion

    Indicator Removal

    2
    T1070

    File Deletion

    2
    T1070.004

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    3
    T1490

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\Documents\!$R4GN4R_66A976E8$!.txt
      Filesize

      4KB

      MD5

      f404b04194e67dec4e42b2027b2484da

      SHA1

      85d07ad4115c52d7a87f886ce51437a7612c7db6

      SHA256

      046ee39ba91ca3d6f636258184e08d4e0a86ba4a41f7e80169680037d46a471e

      SHA512

      77eff6a6df04fb16c8be4e10897b40df20e9cc1a0e3b93c51ee187eb11f09f9a448bdd667c6025b4ad674b206be96eb6ebcda901e05840b58d16d97b5705bb2f

      Download Submit
    • memory/2988-0-0x0000000000C30000-0x0000000000C45000-memory.dmp
      Filesize

      84KB

      Download
    • memory/2988-4-0x0000000000C30000-0x0000000000C45000-memory.dmp
      Filesize

      84KB

      Download
    • memory/2988-6-0x0000000000C30000-0x0000000000C45000-memory.dmp
      Filesize

      84KB

      Download
    • memory/2988-7195-0x0000000000C30000-0x0000000000C45000-memory.dmp
      Filesize

      84KB

      Download
    • memory/2988-14657-0x0000000000C30000-0x0000000000C45000-memory.dmp
      Filesize

      84KB

      Download