ragnarlocker | 04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87

General

Target

CWT_company_ragnar_locker.exe
Size

54KB
MD5

574f3513f6d7e15f102e82e4d35bf164
SHA1

f7a38385fe41bcd154fc7b6da034bfe719d6a0a7
SHA256

04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87
SHA512

a6ffed4af6cbbeb0bd95ce4ea801d25669540d71ddf4d41aaf2fbf51b0820802fee90bca5981cb498ed0945c1149acf820990e57f6deb845380d343d2a6e9350

Score

10^/10

ransomware evasion persistence ragnarlocker bootkit

Malware Config

Extracted

Path

C:\Users\Public\Documents\!$R4GN4R_F0C1BF83$!.txt

Family

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO CWT_company ! IF YOU ARE READING THIS, IT'S MEAN YOUR DATA WAS ENCRYPTED AND YOU SENSITIVE PRIVATE INFORMATION WAS STOLEN! READ CAREFULLY THE WHOLE INSTRUCTION NOTES TO AVOID DIFFICULTIES WITH YOUR DATA by RAGNAR_LOCKER ! ***************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for the special DECRYPTION KEY ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof that it Works. Don't waste your TIME, the link for contact us will be deleted if there is no contact made in closest time and you will NEVER restore your DATA. !!! HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ! WARNING ! Whole your network was fully COMPROMISED! We has DOWNLOADED more than 2 TB of your PRIVATE SENSITIVE Data, including your Billing info, Insuranse cases, Financial reports, Business audit, Banking Accounts! Also we have corporate correspondence, information about your clients such as AXA Equitable, Abbot Laboratories, AIG, Amazon, Boston Scientific, Facebook, J & J, SONOCO, Estee Lauder and many others. We got even more info about your partners and even about your staff, there are some screenshots just as a proofs of what we got on you. Screenshots: http://prntscr.com/to31n0 (from here was downloaded almost every file) https://prnt.sc/to2kqq https://prnt.sc/to2lbp https://prnt.sc/tnzooz your trial balances in USD https://prnt.sc/tnzqxf https://prnt.sc/to2qlx http://prnt.sc/to2rab ------------------------------------- Whole data that gathered from your private files and directories could be published in MASS MEDIA for BREAKING NEWS! Yours partners, clients and investors would be notified about LEAK. However if we make a deal everything would be kept in secret and all your data will be restored. You can take a look for some more examples of what we have, right now it's a private hidden page, but it could become accessable for Public View if you decide NOT pay. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/?BatxqaHm8rKxIP16Z1xB to view the page's content use password: GME5sYUN0A ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?bC2aAD71E2976da53FC1Efc3193c8FDeA0BAeF8A37883c9e05d3BFF82CCfE8Ee c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/?BatxqaHm8rKxIP16Z1xB ( password: GME5sYUN0A ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN KEY R_R--- YkMyYUFENzFFMjk3NmRhNTNGQzFFZmMzMTkzYzhGRGVBMEJBZUY4QTM3ODgzYzllMDVkM0JGRjgyQ0NmRThFZQ== ---END KEY R_R--- ***********************************************************************************

URLs

http://prntscr.com/to31n0

https://prnt.sc/to2kqq

https://prnt.sc/to2lbp

https://prnt.sc/tnzooz

https://prnt.sc/tnzqxf

https://prnt.sc/to2qlx

http://prnt.sc/to2rab

http://p6o7m73ujalhgkiv.onion/?BatxqaHm8rKxIP16Z1xB

http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?bC2aAD71E2976da53FC1Efc3193c8FDeA0BAeF8A37883c9e05d3BFF82CCfE8Ee

Signatures

Drops file in Program Files directory 2455 IoCs

Processes:

CWT_company_ragnar_locker.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Common Files\System\Ole DB\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Common Files\Microsoft Shared\TextConv\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\PREVIEW.GIF	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\THMBNAIL.PNG	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\handsafe.reg	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv	CWT_company_ragnar_locker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png	CWT_company_ragnar_locker.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\!$R4GN4R_F0C1BF83$!.txt	CWT_company_ragnar_locker.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

CWT_company_ragnar_locker.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 CWT_company_ragnar_locker.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	CWT_company_ragnar_locker.exe

Suspicious behavior: EnumeratesProcesses 65 IoCs

Processes:

CWT_company_ragnar_locker.exe

pid	process
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe
240	CWT_company_ragnar_locker.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

CWT_company_ragnar_locker.exe

description	pid	process	target process
PID 240 wrote to memory of 1016	240	CWT_company_ragnar_locker.exe	wmic.exe
PID 240 wrote to memory of 1016	240	CWT_company_ragnar_locker.exe	wmic.exe
PID 240 wrote to memory of 1016	240	CWT_company_ragnar_locker.exe	wmic.exe
PID 240 wrote to memory of 1016	240	CWT_company_ragnar_locker.exe	wmic.exe
PID 240 wrote to memory of 2028	240	CWT_company_ragnar_locker.exe	vssadmin.exe
PID 240 wrote to memory of 2028	240	CWT_company_ragnar_locker.exe	vssadmin.exe
PID 240 wrote to memory of 2028	240	CWT_company_ragnar_locker.exe	vssadmin.exe
PID 240 wrote to memory of 2028	240	CWT_company_ragnar_locker.exe	vssadmin.exe
PID 240 wrote to memory of 1068	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1068	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1068	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1068	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1500	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1500	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1500	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1500	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1796	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1796	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1796	240	CWT_company_ragnar_locker.exe	bcdedit.exe
PID 240 wrote to memory of 1796	240	CWT_company_ragnar_locker.exe	bcdedit.exe

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exe

pid process

1068 bcdedit.exe
1500 bcdedit.exe
1796 bcdedit.exe

pid	process
1068	bcdedit.exe
1500	bcdedit.exe
1796	bcdedit.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

CWT_company_ragnar_locker.exewmic.exevssvc.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	240	CWT_company_ragnar_locker.exe
Token: SeRestorePrivilege	240	CWT_company_ragnar_locker.exe
Token: SeIncreaseQuotaPrivilege	1016	wmic.exe
Token: SeSecurityPrivilege	1016	wmic.exe
Token: SeTakeOwnershipPrivilege	1016	wmic.exe
Token: SeLoadDriverPrivilege	1016	wmic.exe
Token: SeSystemProfilePrivilege	1016	wmic.exe
Token: SeSystemtimePrivilege	1016	wmic.exe
Token: SeProfSingleProcessPrivilege	1016	wmic.exe
Token: SeIncBasePriorityPrivilege	1016	wmic.exe
Token: SeCreatePagefilePrivilege	1016	wmic.exe
Token: SeBackupPrivilege	1016	wmic.exe
Token: SeRestorePrivilege	1016	wmic.exe
Token: SeShutdownPrivilege	1016	wmic.exe
Token: SeDebugPrivilege	1016	wmic.exe
Token: SeSystemEnvironmentPrivilege	1016	wmic.exe
Token: SeRemoteShutdownPrivilege	1016	wmic.exe
Token: SeUndockPrivilege	1016	wmic.exe
Token: SeManageVolumePrivilege	1016	wmic.exe
Token: 33	1016	wmic.exe
Token: 34	1016	wmic.exe
Token: 35	1016	wmic.exe
Token: SeBackupPrivilege	676	vssvc.exe
Token: SeRestorePrivilege	676	vssvc.exe
Token: SeAuditPrivilege	676	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1016	wmic.exe
Token: SeSecurityPrivilege	1016	wmic.exe
Token: SeTakeOwnershipPrivilege	1016	wmic.exe
Token: SeLoadDriverPrivilege	1016	wmic.exe
Token: SeSystemProfilePrivilege	1016	wmic.exe
Token: SeSystemtimePrivilege	1016	wmic.exe
Token: SeProfSingleProcessPrivilege	1016	wmic.exe
Token: SeIncBasePriorityPrivilege	1016	wmic.exe
Token: SeCreatePagefilePrivilege	1016	wmic.exe
Token: SeBackupPrivilege	1016	wmic.exe
Token: SeRestorePrivilege	1016	wmic.exe
Token: SeShutdownPrivilege	1016	wmic.exe
Token: SeDebugPrivilege	1016	wmic.exe
Token: SeSystemEnvironmentPrivilege	1016	wmic.exe
Token: SeRemoteShutdownPrivilege	1016	wmic.exe
Token: SeUndockPrivilege	1016	wmic.exe
Token: SeManageVolumePrivilege	1016	wmic.exe
Token: 33	1016	wmic.exe
Token: 34	1016	wmic.exe
Token: 35	1016	wmic.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2028 vssadmin.exe
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker

pid	process
2028	vssadmin.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

CWT_company_ragnar_locker.exe

description	ioc	process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini	CWT_company_ragnar_locker.exe

C:\Users\Admin\AppData\Local\Temp\CWT_company_ragnar_locker.exe
"C:\Users\Admin\AppData\Local\Temp\CWT_company_ragnar_locker.exe"
1⤵
- Drops file in Program Files directory
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops desktop.ini file(s)
PID:240

C:\Windows\System32\Wbem\wmic.exe
wmic.exe shadowcopy delete
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2028

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled No
2⤵
- Modifies boot configuration data using bcdedit
PID:1068

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
2⤵
- Modifies boot configuration data using bcdedit
PID:1500

C:\Windows\system32\bcdedit.exe
bcdedit /set {globalsettings} advancedoptions false
2⤵
- Modifies boot configuration data using bcdedit
PID:1796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:676

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-115-0x0000000003740000-0x0000000003751000-memory.dmp

Filesize
68KB

Download
memory/240-7-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-2-0x0000000002F20000-0x0000000002F31000-memory.dmp

Filesize
68KB

Download
memory/240-130-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/240-11-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-15-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-19-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-23-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-25-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-29-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-128-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/240-37-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-126-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/240-47-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-51-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-57-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-65-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-75-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-85-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-93-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-33-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-1-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-43-0x0000000003330000-0x0000000003341000-memory.dmp

Filesize
68KB

Download
memory/240-125-0x0000000003740000-0x0000000003751000-memory.dmp

Filesize
68KB

Download
memory/240-124-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/240-107-0x00000000042C0000-0x00000000042D1000-memory.dmp

Filesize
68KB

Download
memory/240-108-0x00000000046D0000-0x00000000046E1000-memory.dmp

Filesize
68KB

Download
memory/240-109-0x0000000004690000-0x00000000046A1000-memory.dmp

Filesize
68KB

Download
memory/240-110-0x0000000006870000-0x0000000006881000-memory.dmp

Filesize
68KB

Download
memory/240-111-0x0000000006870000-0x0000000006881000-memory.dmp

Filesize
68KB

Download
memory/240-112-0x00000000083D0000-0x00000000083E1000-memory.dmp

Filesize
68KB

Download
memory/240-113-0x0000000004690000-0x00000000046A1000-memory.dmp

Filesize
68KB

Download
memory/240-114-0x0000000005B30000-0x0000000005B41000-memory.dmp

Filesize
68KB

Download
memory/240-0-0x0000000002F20000-0x0000000002F31000-memory.dmp

Filesize
68KB

Download
memory/240-116-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/240-117-0x0000000003740000-0x0000000003751000-memory.dmp

Filesize
68KB

Download
memory/240-118-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/240-120-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/240-122-0x0000000003B50000-0x0000000003B61000-memory.dmp

Filesize
68KB

Download
memory/1016-102-0x0000000000000000-mapping.dmp

Download
memory/1068-104-0x0000000000000000-mapping.dmp

Download
memory/1500-105-0x0000000000000000-mapping.dmp

Download
memory/1796-106-0x0000000000000000-mapping.dmp

Download
memory/2028-103-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads