Procedure examples

Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.

Ramsay has included a rootkit to evade defenses.

Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.

Ramsay can collect data from removable media and stage it for exfiltration.

Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.

Ramsay has PE data embedded within JPEG files contained within Word documents.

Ramsay has masqueraded as a JPG image file.

Ramsay has masqueraded as a 7zip installer.

Ramsay can collect data from network drives and stage it for exfiltration.

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

Ramsay can use netstat to enumerate network connections.

Ramsay can schedule tasks via the Windows COM API to maintain persistence.

Ramsay can use ImprovedReflectiveDLLInjection to deploy components.

Ramsay can gather a list of running processes by using Tasklist.

Ramsay has included embedded Visual Basic scripts in malicious documents.

Ramsay has used HTTP for C2.

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.

Ramsay can spread itself by infecting other portable executable files on networks shared drives.

Ramsay can collect directory and file lists.

Ramsay can spread itself by infecting other portable executable files on removable drives.

Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.

Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.

Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.

Ramsay can scan for removable media which may contain documents for collection.

Ramsay has used base64 to encode its C2 traffic.

Ramsay can scan for network drives which may contain documents for collection.

Ramsay can extract its agent from the body of a malicious document.

Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.

Ramsay has been executed through malicious e-mail attachments.

Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.

Ramsay has created Registry Run keys to establish persistence.

Ramsay can use UACMe for privilege escalation.

Ramsay can use the Windows COM API to schedule tasks and maintain persistence.

Ramsay has been delivered using OLE objects in malicious documents.

Ramsay can compress and archive collected files using WinRAR.

Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.

Ramsay has been distributed through spearphishing emails with malicious attachments.

Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.

Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.