Full Report
Our ThreatOps team details stumbling across Raccine, a ransomware remedy that works by hooking onto IFEO debuggers, for the first time.
Analysis Summary
# Tool/Technique: Raccine
## Overview
Raccine is a public, open-source "ransomware vaccine" or remedy designed to prevent ransomware from deleting Shadow Copies. It serves as a defensive utility that intercepts specific command-line activities commonly used by ransomware during the encryption phase. By leveraging a technique typically associated with malware persistence, it monitors and terminates malicious process trees before data destruction occurs.
## Technical Details
- **Type:** Defensive Tool / Security Utility
- **Platform:** Windows
- **Capabilities:** Process hooking, command-line monitoring, process termination, and ransomware neutralization.
- **First Seen:** Publicized and analyzed by Huntress in June 2021 (maintained by Florian Roth).
## MITRE ATT&CK Mapping
*Note: While Raccine is a defensive tool, it utilizes techniques often classified under the ATT&CK framework when used by adversaries.*
- **[TA0003 - Persistence]**
- **[T1546.012 - Event Triggered Execution: Image File Execution Options Injection]**
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]** (Applied defensively to neutralize malware)
- **[TA0040 - Impact]**
- **[T1490 - Inhibit System Recovery]** (Raccine specifically monitors and blocks this technique)
## Functionality
### Core Capabilities
- **IFEO Hooking:** Raccine registers itself as a "debugger" for native Windows binaries (e.g., `vssadmin.exe`, `wmic.exe`) using the Image File Execution Options (IFEO) registry key.
- **Command-Line Analysis:** When a hooked program is called, Raccine intercepts the execution and scans the command-line arguments for "unsafe" syntax.
- **Process Termination:** If malicious activity is detected (such as attempts to delete shadow copies), Raccine prevents the execution of the command and terminates the entire parent process tree to stop the ransomware caller.
### Advanced Features
- **Generic Methodology:** Unlike signature-based antivirus, it uses a behavioral approach that targets a specific stage of the ransomware lifecycle (inhibiting recovery).
- **Non-Invasive:** It does not clobber or modify original system files; it utilizes built-in Windows debugging features to redirect execution.
## Indicators of Compromise
*Note: These are indicators of the tool's presence, which may be flagged as suspicious due to its use of IFEO hooks.*
- **File Names:** `raccine.exe`, `RaccineSettings.exe`, `RaccineElevated.exe`
- **Registry Keys:**
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exe` (Value: `Debugger` = `raccine.exe`)
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exe`
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exe`
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe`
- **Behavioral Indicators:** A process (like `vssadmin.exe`) being frequently followed by the immediate termination of its parent process.
## Associated Threat Actors
- **N/A:** This is a defensive tool. However, the **IFEO Injection** technique is widely used by various APT groups and commodity malware for persistence.
## Detection Methods
- **Behavioral Detection:** Monitoring for the modification of the `Image File Execution Options` registry keys, especially for critical system binaries like `vssadmin.exe` or `cmd.exe`.
- **Signature-based:** Detection of the `Raccine` binary or its unique logo/icon resources within the `Program Files` directory.
- **EDR Alerts:** Modern EDRs may alert on "Suspicious Debugger Registration" if they do not have Raccine on an allow-list.
## Mitigation Strategies
- **Registry Protection:** Restrict write access to the IFEO registry keys to prevent unauthorized debuggers from being registered.
- **Whitelisting:** If using Raccine, ensure the security stack is configured to recognize its legitimate use of IFEO to avoid false positives.
## Related Tools/Techniques
- **IFEO Persistence:** A common technique where malware sets itself as the "debugger" for `sethc.exe` (Sticky Keys) or `utilman.exe` to gain SYSTEM access.
- **vssadmin.exe / shadowcopy:** Native Windows tools frequently targeted by ransomware variants like Conti, Ryuk, and Maze.