bce46dfea77df9cd1109c732b9a26a8888ecf8665116a94254b35341989ffc57 | Triage

Sharing

General

Target

ratnik.exe
Size

283KB
Sample

240425-wsj34adc4z
MD5

cd2549b04a34bfecaa580c13aad997ff
SHA1

9754b3f5443513d79c4df458eac36c8e6e31df4a
SHA256

bce46dfea77df9cd1109c732b9a26a8888ecf8665116a94254b35341989ffc57
SHA512

2a7a74bf8bdb79b36929e7384e16fcc186a9e5c5d65566068c9b69ea138737755861b1f7fc5158e085b731de2a7389c3c979ff85c2cd99ed9b89b38c8f05e39f
SSDEEP

6144:pEDbtVkjwfWi3Le6VlWT8b9EqP4Xo5qDmb1Ugp:p8XNPVle8SqSDkVp

Score

10^/10

persistence ransomware

Malware Config

Targets

- Target
  
  ratnik.exe
- Size
  
  283KB
- MD5
  
  cd2549b04a34bfecaa580c13aad997ff
- SHA1
  
  9754b3f5443513d79c4df458eac36c8e6e31df4a
- SHA256
  
  bce46dfea77df9cd1109c732b9a26a8888ecf8665116a94254b35341989ffc57
- SHA512
  
  2a7a74bf8bdb79b36929e7384e16fcc186a9e5c5d65566068c9b69ea138737755861b1f7fc5158e085b731de2a7389c3c979ff85c2cd99ed9b89b38c8f05e39f
- SSDEEP
  
  6144:pEDbtVkjwfWi3Le6VlWT8b9EqP4Xo5qDmb1Ugp:p8XNPVle8SqSDkVp
Score

10^/10

persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Modifies AppInit DLL entries
  persistence
- Loads dropped DLL
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

persistenceransomware