Malware

Ranscam

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053.005Scheduled TaskEvidence2

First, it copies itself into %APPDATA%\ and uses Task Scheduler to create a scheduled task that is configured to start itself each time the system is started.

T1059.001PowerShellEvidence2

The script then uses powershell to facilitate the retrieval of the JPEG used to render the ransom note.

T1059.003Windows Command ShellEvidence2

The executable called by this scheduled task uses the Windows Command Processor to call a batch file which is responsible for the majority of the destructive activity associated with this ransomware.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence2

First, it copies itself into %APPDATA%\ and uses Task Scheduler to create a scheduled task that is configured to start itself each time the system is started.

T1112Modify RegistryEvidence2

Deleting several registry key associated with booting into Safe Mode Setting registry keys to disable Task Manager Setting the Keyboard Scancode Map

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

First, it copies itself into %APPDATA%\ and uses Task Scheduler to create a scheduled task that is configured to start itself each time the system is started.

Stealth

3 techniques

T1036MasqueradingEvidence1

It purports to have moved the user’s files to a “hidden, encrypted partition”... There is no actual verification occurring... The author is simply relying on “smoke and mirrors” in an attempt to convince victims that their files can be recovered

T1070.004File DeletionEvidence1

The script also performs several other destructive actions on the infected system, including the following: Deleting the core Windows executable responsible for System Restores Deleting shadow copies

T1218.001Compiled HTML FileEvidence1

"...two framed elements that are remotely retrieved using Internet Explorer each time the note is displayed."

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

Deleting several registry key associated with booting into Safe Mode Setting registry keys to disable Task Manager Setting the Keyboard Scancode Map

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

What is actually occurring is the malware is simply making two HTTP GET requests to obtain the PNG images that it uses to simulate the verification process.

T1105Ingress Tool TransferEvidence2

The script then uses powershell to facilitate the retrieval of the JPEG used to render the ransom note.

Impact

3 techniques

T1485Data DestructionEvidence3

The batch file simply iterates through several folders within the victim’s file system... however instead of encrypting the victim’s files, it simply deletes all contents.

T1490Inhibit System RecoveryEvidence1

"Deleting shadow copies"; "Deleting the core Windows executable responsible for System Restores"; "Deleting several registry key associated with booting into Safe Mode"

T1529System Shutdown/RebootEvidence2

Once the aforementioned activities are completed, the script then forces a system shutdown. These activities are repeated each time the system boots up following the infection

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

9 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app10 years ago

hash.sha256●●●●●●●●●●●●View more in app10 years ago

ip.v4●●●●●●●●●●●●View more in app10 years ago

domain●●●●●●●●●●●●View more in app10 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

the registerNews

Aug 10, 2016

Hitler ‘ransomware’ offers to sell you back access to your files - but just deletes them

A fake ransomware/wiper previously observed claiming to encrypt files while actually deleting them.

talos intelligence blogNews

Jul 11, 2016

When Paying Out Doesn't Pay Off

A low-sophistication .NET ransomware/scareware that does not encrypt files; instead it deletes victim files and uses a fake ransom note/payment “verification” UI (images fetched via HTTP) to coerce payment despite having no recovery capability. Persists via copying to %APPDATA% and a scheduled task; drops a secondary executable and uses a batch script to delete files, shadow copies, system restore components, and modifies registry settings (e.g., disable Task Manager, Safe Mode keys), then forces shutdown and repeats on reboot.

talosintel blogNews

Jul 11, 2016

When Paying Out Doesn't Pay Off

A crude ransomware/scareware family that pretends files were moved to a hidden encrypted partition and simulates payment verification, but in reality deletes victim files rather than encrypting them and offers no recovery capability. It establishes persistence via Task Scheduler, drops components, deletes files and recovery mechanisms, displays a ransom note, and forces shutdowns on reboot.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Ranscam

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1053.005Scheduled TaskEvidence2

First, it copies itself into %APPDATA%\ and uses Task Scheduler to create a scheduled task that is configured to start itself each time the system is started.

T1059.001PowerShellEvidence2

The script then uses powershell to facilitate the retrieval of the JPEG used to render the ransom note.

T1059.003Windows Command ShellEvidence2

The executable called by this scheduled task uses the Windows Command Processor to call a batch file which is responsible for the majority of the destructive activity associated with this ransomware.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence2

First, it copies itself into %APPDATA%\ and uses Task Scheduler to create a scheduled task that is configured to start itself each time the system is started.

T1112Modify RegistryEvidence2

Deleting several registry key associated with booting into Safe Mode Setting registry keys to disable Task Manager Setting the Keyboard Scancode Map

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

First, it copies itself into %APPDATA%\ and uses Task Scheduler to create a scheduled task that is configured to start itself each time the system is started.

Stealth

3 techniques

T1036MasqueradingEvidence1

T1070.004File DeletionEvidence1

The script also performs several other destructive actions on the infected system, including the following: Deleting the core Windows executable responsible for System Restores Deleting shadow copies

T1218.001Compiled HTML FileEvidence1

"...two framed elements that are remotely retrieved using Internet Explorer each time the note is displayed."

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

Deleting several registry key associated with booting into Safe Mode Setting registry keys to disable Task Manager Setting the Keyboard Scancode Map

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

What is actually occurring is the malware is simply making two HTTP GET requests to obtain the PNG images that it uses to simulate the verification process.

T1105Ingress Tool TransferEvidence2

The script then uses powershell to facilitate the retrieval of the JPEG used to render the ransom note.

Impact

3 techniques

T1485Data DestructionEvidence3

The batch file simply iterates through several folders within the victim’s file system... however instead of encrypting the victim’s files, it simply deletes all contents.

T1490Inhibit System RecoveryEvidence1

"Deleting shadow copies"; "Deleting the core Windows executable responsible for System Restores"; "Deleting several registry key associated with booting into Safe Mode"

T1529System Shutdown/RebootEvidence2

Once the aforementioned activities are completed, the script then forces a system shutdown. These activities are repeated each time the system boots up following the infection

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

9 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app10 years ago

hash.sha256●●●●●●●●●●●●View more in app10 years ago

ip.v4●●●●●●●●●●●●View more in app10 years ago

domain●●●●●●●●●●●●View more in app10 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

the registerNews

Aug 10, 2016

Hitler ‘ransomware’ offers to sell you back access to your files - but just deletes them

A fake ransomware/wiper previously observed claiming to encrypt files while actually deleting them.

talos intelligence blogNews

Jul 11, 2016

When Paying Out Doesn't Pay Off

talosintel blogNews

Jul 11, 2016

When Paying Out Doesn't Pay Off

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.