Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
10Ransomware...KB.msi
windows10-ltsc_2021-x64
Ransomware...KB.msi
windows7-x64
Ransomware...KB.msi
windows10-2004-x64
Ransomware...KB.msi
windows10-ltsc_2021-x64
Ransomware...KB.msi
windows11-21h2-x64
Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows7-x64
10Ransomware...KB.exe
windows10-2004-x64
10Ransomware...KB.exe
windows10-ltsc_2021-x64
10Ransomware...KB.exe
windows11-21h2-x64
5Ransomware...KB.ps1
windows10-ltsc_2021-x64
Ransomware...KB.ps1
windows7-x64
Ransomware...KB.ps1
windows10-2004-x64
Ransomware...KB.ps1
windows10-ltsc_2021-x64
Ransomware...KB.ps1
windows11-21h2-x64
Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
RansomwareSamples/RansomEXX_14_12_2020_156KB.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral2
Sample
RansomwareSamples/RansomEXX_14_12_2020_156KB.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral3
Sample
RansomwareSamples/RansomEXX_14_12_2020_156KB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
RansomwareSamples/RansomEXX_14_12_2020_156KB.exe
Resource
win10ltsc2021-20250313-en
windows10-ltsc_2021-x64
Behavioral task
behavioral5
Sample
RansomwareSamples/RansomEXX_14_12_2020_156KB.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
RansomwareSamples/Ranzy_20_11_2020_138KB.exe
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
RansomwareSamples/Ranzy_20_11_2020_138KB.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
RansomwareSamples/Ranzy_20_11_2020_138KB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
RansomwareSamples/Ranzy_20_11_2020_138KB.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral10
Sample
RansomwareSamples/Ranzy_20_11_2020_138KB.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
RansomwareSamples/Ryuk_21_03_2021_274KB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
RansomwareSamples/Ryuk_21_03_2021_274KB.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral13
Sample
RansomwareSamples/Ryuk_21_03_2021_274KB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
RansomwareSamples/Ryuk_21_03_2021_274KB.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral15
Sample
RansomwareSamples/Ryuk_21_03_2021_274KB.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral17
Sample
RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral20
Sample
RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
RansomwareSamples/Sodinokibi_04_07_2019_253KB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
RansomwareSamples/Sodinokibi_04_07_2019_253KB.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
RansomwareSamples/Sodinokibi_04_07_2019_253KB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
RansomwareSamples/Sodinokibi_04_07_2019_253KB.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral25
Sample
RansomwareSamples/Sodinokibi_04_07_2019_253KB.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
RansomwareSamples/SunCrypt_26_01_2021_1422KB.ps1
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral27
Sample
RansomwareSamples/SunCrypt_26_01_2021_1422KB.ps1
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
RansomwareSamples/SunCrypt_26_01_2021_1422KB.ps1
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
RansomwareSamples/SunCrypt_26_01_2021_1422KB.ps1
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral30
Sample
RansomwareSamples/SunCrypt_26_01_2021_1422KB.ps1
Resource
win11-20250314-en
windows11-21h2-x64
General
-
Target
RansomwareSamples/Ranzy_20_11_2020_138KB.exe
-
Size
138KB
-
MD5
954479f95ce67fcb855c5b882d68e74b
-
SHA1
43ccf398999f70b613e1353cfb6845ee09b393ca
-
SHA256
c4f72b292750e9332b1f1b9761d5aefc07301bc15edf31adeaf2e608000ec1c9
-
SHA512
515e675401ec67d2d06f06264cb33808ad7d214a0609492ddf73f40a3b829358d75f79fff04b29c6953fc3f450c0d55207d5a6fd3b571f60ae05e25327c41a5f
-
SSDEEP
3072:WNnBEPCZ788hExMfHg/50iIETyyCDRk8gE9QIluYEh0VZvcWrMFh:WPEa586nHg/50/ET3CoE7uYEau
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\readme.txt
https://ranzylock.hk/N6CFBPYX
http://a6a5b4ppnkrio3nikyutfexbc6y5dc6kfhj3jr32kdwbryr2lempkuyd.onion/N6CFBPYX
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (289) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\A: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\E: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\I: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\S: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\X: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\Y: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\B: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\H: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\P: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\T: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\Z: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\F: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\J: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\K: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\N: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\Q: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\U: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\G: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\L: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\M: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\O: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\R: Ranzy_20_11_2020_138KB.exe File opened (read-only) \??\V: Ranzy_20_11_2020_138KB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ranzy_20_11_2020_138KB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Interacts with shadow copies 3 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2956 vssadmin.exe 2732 vssadmin.exe 2844 vssadmin.exe 2544 vssadmin.exe 2932 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe 2148 Ranzy_20_11_2020_138KB.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2088 wmic.exe Token: SeSecurityPrivilege 2088 wmic.exe Token: SeTakeOwnershipPrivilege 2088 wmic.exe Token: SeLoadDriverPrivilege 2088 wmic.exe Token: SeSystemProfilePrivilege 2088 wmic.exe Token: SeSystemtimePrivilege 2088 wmic.exe Token: SeProfSingleProcessPrivilege 2088 wmic.exe Token: SeIncBasePriorityPrivilege 2088 wmic.exe Token: SeCreatePagefilePrivilege 2088 wmic.exe Token: SeBackupPrivilege 2088 wmic.exe Token: SeRestorePrivilege 2088 wmic.exe Token: SeShutdownPrivilege 2088 wmic.exe Token: SeDebugPrivilege 2088 wmic.exe Token: SeSystemEnvironmentPrivilege 2088 wmic.exe Token: SeRemoteShutdownPrivilege 2088 wmic.exe Token: SeUndockPrivilege 2088 wmic.exe Token: SeManageVolumePrivilege 2088 wmic.exe Token: 33 2088 wmic.exe Token: 34 2088 wmic.exe Token: 35 2088 wmic.exe Token: SeBackupPrivilege 2928 vssvc.exe Token: SeRestorePrivilege 2928 vssvc.exe Token: SeAuditPrivilege 2928 vssvc.exe Token: SeIncreaseQuotaPrivilege 3012 wmic.exe Token: SeSecurityPrivilege 3012 wmic.exe Token: SeTakeOwnershipPrivilege 3012 wmic.exe Token: SeLoadDriverPrivilege 3012 wmic.exe Token: SeSystemProfilePrivilege 3012 wmic.exe Token: SeSystemtimePrivilege 3012 wmic.exe Token: SeProfSingleProcessPrivilege 3012 wmic.exe Token: SeIncBasePriorityPrivilege 3012 wmic.exe Token: SeCreatePagefilePrivilege 3012 wmic.exe Token: SeBackupPrivilege 3012 wmic.exe Token: SeRestorePrivilege 3012 wmic.exe Token: SeShutdownPrivilege 3012 wmic.exe Token: SeDebugPrivilege 3012 wmic.exe Token: SeSystemEnvironmentPrivilege 3012 wmic.exe Token: SeRemoteShutdownPrivilege 3012 wmic.exe Token: SeUndockPrivilege 3012 wmic.exe Token: SeManageVolumePrivilege 3012 wmic.exe Token: 33 3012 wmic.exe Token: 34 3012 wmic.exe Token: 35 3012 wmic.exe Token: SeIncreaseQuotaPrivilege 2736 wmic.exe Token: SeSecurityPrivilege 2736 wmic.exe Token: SeTakeOwnershipPrivilege 2736 wmic.exe Token: SeLoadDriverPrivilege 2736 wmic.exe Token: SeSystemProfilePrivilege 2736 wmic.exe Token: SeSystemtimePrivilege 2736 wmic.exe Token: SeProfSingleProcessPrivilege 2736 wmic.exe Token: SeIncBasePriorityPrivilege 2736 wmic.exe Token: SeCreatePagefilePrivilege 2736 wmic.exe Token: SeBackupPrivilege 2736 wmic.exe Token: SeRestorePrivilege 2736 wmic.exe Token: SeShutdownPrivilege 2736 wmic.exe Token: SeDebugPrivilege 2736 wmic.exe Token: SeSystemEnvironmentPrivilege 2736 wmic.exe Token: SeRemoteShutdownPrivilege 2736 wmic.exe Token: SeUndockPrivilege 2736 wmic.exe Token: SeManageVolumePrivilege 2736 wmic.exe Token: 33 2736 wmic.exe Token: 34 2736 wmic.exe Token: 35 2736 wmic.exe Token: SeIncreaseQuotaPrivilege 2564 wmic.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2088 2148 Ranzy_20_11_2020_138KB.exe 31 PID 2148 wrote to memory of 2088 2148 Ranzy_20_11_2020_138KB.exe 31 PID 2148 wrote to memory of 2088 2148 Ranzy_20_11_2020_138KB.exe 31 PID 2148 wrote to memory of 2088 2148 Ranzy_20_11_2020_138KB.exe 31 PID 2148 wrote to memory of 2956 2148 Ranzy_20_11_2020_138KB.exe 33 PID 2148 wrote to memory of 2956 2148 Ranzy_20_11_2020_138KB.exe 33 PID 2148 wrote to memory of 2956 2148 Ranzy_20_11_2020_138KB.exe 33 PID 2148 wrote to memory of 2956 2148 Ranzy_20_11_2020_138KB.exe 33 PID 2148 wrote to memory of 3012 2148 Ranzy_20_11_2020_138KB.exe 36 PID 2148 wrote to memory of 3012 2148 Ranzy_20_11_2020_138KB.exe 36 PID 2148 wrote to memory of 3012 2148 Ranzy_20_11_2020_138KB.exe 36 PID 2148 wrote to memory of 3012 2148 Ranzy_20_11_2020_138KB.exe 36 PID 2148 wrote to memory of 2732 2148 Ranzy_20_11_2020_138KB.exe 38 PID 2148 wrote to memory of 2732 2148 Ranzy_20_11_2020_138KB.exe 38 PID 2148 wrote to memory of 2732 2148 Ranzy_20_11_2020_138KB.exe 38 PID 2148 wrote to memory of 2732 2148 Ranzy_20_11_2020_138KB.exe 38 PID 2148 wrote to memory of 2736 2148 Ranzy_20_11_2020_138KB.exe 40 PID 2148 wrote to memory of 2736 2148 Ranzy_20_11_2020_138KB.exe 40 PID 2148 wrote to memory of 2736 2148 Ranzy_20_11_2020_138KB.exe 40 PID 2148 wrote to memory of 2736 2148 Ranzy_20_11_2020_138KB.exe 40 PID 2148 wrote to memory of 2844 2148 Ranzy_20_11_2020_138KB.exe 42 PID 2148 wrote to memory of 2844 2148 Ranzy_20_11_2020_138KB.exe 42 PID 2148 wrote to memory of 2844 2148 Ranzy_20_11_2020_138KB.exe 42 PID 2148 wrote to memory of 2844 2148 Ranzy_20_11_2020_138KB.exe 42 PID 2148 wrote to memory of 2564 2148 Ranzy_20_11_2020_138KB.exe 44 PID 2148 wrote to memory of 2564 2148 Ranzy_20_11_2020_138KB.exe 44 PID 2148 wrote to memory of 2564 2148 Ranzy_20_11_2020_138KB.exe 44 PID 2148 wrote to memory of 2564 2148 Ranzy_20_11_2020_138KB.exe 44 PID 2148 wrote to memory of 2544 2148 Ranzy_20_11_2020_138KB.exe 46 PID 2148 wrote to memory of 2544 2148 Ranzy_20_11_2020_138KB.exe 46 PID 2148 wrote to memory of 2544 2148 Ranzy_20_11_2020_138KB.exe 46 PID 2148 wrote to memory of 2544 2148 Ranzy_20_11_2020_138KB.exe 46 PID 2148 wrote to memory of 2668 2148 Ranzy_20_11_2020_138KB.exe 48 PID 2148 wrote to memory of 2668 2148 Ranzy_20_11_2020_138KB.exe 48 PID 2148 wrote to memory of 2668 2148 Ranzy_20_11_2020_138KB.exe 48 PID 2148 wrote to memory of 2668 2148 Ranzy_20_11_2020_138KB.exe 48 PID 2148 wrote to memory of 2932 2148 Ranzy_20_11_2020_138KB.exe 50 PID 2148 wrote to memory of 2932 2148 Ranzy_20_11_2020_138KB.exe 50 PID 2148 wrote to memory of 2932 2148 Ranzy_20_11_2020_138KB.exe 50 PID 2148 wrote to memory of 2932 2148 Ranzy_20_11_2020_138KB.exe 50 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Ranzy_20_11_2020_138KB.exeC:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Ranzy_20_11_2020_138KB.exe bcdedit /set shutdown /r /f /t 21⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2956
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2732
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2844
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2544
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2932
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c7fc80698e21bc8b4e9c8032747f1726
SHA1881abef3e60039be98b54ad0a22df910d42a085d
SHA25635794acc1c48f49508d07ea68fc4d500d95905a73ba20c74e24e7fa654179dc3
SHA512805ea229aaebe646ad02f44d42dd816d6d01cf76b34f118762e29b2970e7d1dfa4138d475abfcf15593d864eb59f882a0dd4c077d86b26cf403598e0a06d1350