Overview

overview

10

Static

static

1

RanSimSetup.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RanSimSetup.exe

  • Size

    8.7MB

  • Sample

    240113-3b7w6aggh9

  • MD5

    39545865ce9ace414fc4f29ec6c8673e

  • SHA1

    da14d58e6c74f9f7dbd2c5fd64a134cd79123125

  • SHA256

    08170785465dc7f5faf49dd7eb3ee089cdcb5c0149e9170003554986f37fbd76

  • SHA512

    2b9b9d1dbc70f248e6b690ca635f55f7cbeac0f7c3a07d69b2a82eda525273f8a6fe0e86738011ace8d16f255bf1ceba5e187bd5708567583e77b217ae84e1bf

  • SSDEEP

    196608:iilHP1BcV8dMrQW71ngPly38QYx9d3Om3Hz2pzoHfvwPWUp9n:iCHt6V0iQWB0Qa9d3v3Hz2pzoXwPxPn

Score
10/10
lockyagilenetdiscoverypersistenceransomware

Malware Config

Targets

    • Target

      RanSimSetup.exe

    • Size

      8.7MB

    • MD5

      39545865ce9ace414fc4f29ec6c8673e

    • SHA1

      da14d58e6c74f9f7dbd2c5fd64a134cd79123125

    • SHA256

      08170785465dc7f5faf49dd7eb3ee089cdcb5c0149e9170003554986f37fbd76

    • SHA512

      2b9b9d1dbc70f248e6b690ca635f55f7cbeac0f7c3a07d69b2a82eda525273f8a6fe0e86738011ace8d16f255bf1ceba5e187bd5708567583e77b217ae84e1bf

    • SSDEEP

      196608:iilHP1BcV8dMrQW71ngPly38QYx9d3Om3Hz2pzoHfvwPWUp9n:iCHt6V0iQWB0Qa9d3v3Hz2pzoXwPxPn

    Score
    10/10
    lockyagilenetdiscoverypersistenceransomware

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

      ransomwarelocky

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Renames multiple (87) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks