ragnarlocker | 1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033

General

Target

birch_ragnarlocker.exe
Size

49KB
MD5

3dabfb99101821ae0e89389a9c9d28a5
SHA1

72b19c503a642770945355ea0dce96bf9d735f81
SHA256

1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033
SHA512

131487a835f81a774b43155364a683b054b342c5176fe19264a4f9a510c6571532b1cb081011a09f733dee836192240cd36b419979832a601001b14ccbc5ff18

Score

10^/10

ransomware persistence ragnarlocker bootkit

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_AC7AABB2.txt

Family

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO Birch.com,Cbeyond ! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED Although your security measures already been BREACHED and your files were LOCKED, we was able to make a PENETRATION of your network AGAIN! by RAGNAR_LOCKER ! ***************************************************************************************************************** Your systems are very far from perfectly secured, so even after the first penetration you didn't fix and close vulnerabilities and we again have access to your network, it would be a big amazement in the news that you allowed second leakage! !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Shutdown or reset your system ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special decryption key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities Don't waste your TIME, the link for contacting us will be deleted if there is no contact made in closest future and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. WARNING ! We has downloaded a lot of your private Data, including your biling info, business licenses, credit info, finance reports, business audit, Banking information and many other interesting things! Also we have an personal correspondence and information about your clients and partners and even about your staff, there are some screenshots just as a proofs. https://prnt.sc/sfle2v http://prnt.sc/sflk1s http://prnt.sc/sflkc8 http://prnt.sc/sflkn2 Whole data gathered from your SECRET files and directories could be published for everyone's view and your partners, clients and investors would be notified about leak. However if we make a deal everything would be kept in secret and all your data will be restored. You can find post already published regarding LEAKS from your company and it would be updated about the SECOND LEAK in less than one MONTH ! Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/2020/03/18/leaks-from-communicate-giant/ ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?6C3B93D0480953d13302f18DD4a6C0C4e59cDae6D4f88Ed5c98cE8fCD0F9D6cE c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/2020/03/18/leaks-from-communicate-giant/ d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). ?��| *********************************************************************************** ---RAGNAR SECRET--- NkMzQjkzRDA0ODA5NTNkMTMzMDJmMThERDRhNkMwQzRlNTljRGFlNkQ0Zjg4RWQ1Yzk4Y0U4ZkNEMEY5RDZjRQ== ---RAGNAR SECRET--- ***********************************************************************************

URLs

https://prnt.sc/sfle2v

http://prnt.sc/sflk1s

http://prnt.sc/sflkc8

http://prnt.sc/sflkn2

http://p6o7m73ujalhgkiv.onion/2020/03/18/leaks-from-communicate-giant/

http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?6C3B93D0480953d13302f18DD4a6C0C4e59cDae6D4f88Ed5c98cE8fCD0F9D6cE

Signatures

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

birch_ragnarlocker.exe

pid	process
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe
336	birch_ragnarlocker.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

828 vssadmin.exe

pid	process
828	vssadmin.exe

Drops file in Program Files directory 10153 IoCs

Processes:

birch_ragnarlocker.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\REFINED.ELM	birch_ragnarlocker.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo	birch_ragnarlocker.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ERROR.GIF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\calendar.css	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182689.JPG	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau	birch_ragnarlocker.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	birch_ragnarlocker.exe
File created	C:\Program Files\DVD Maker\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\CONVERT\1033\PABR.SAM	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\CATALOG.DPV	birch_ragnarlocker.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.APL	birch_ragnarlocker.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9B.GIF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\BIZFORM.XML	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107544.WMF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html	birch_ragnarlocker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png	birch_ragnarlocker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png	birch_ragnarlocker.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\SPANISH.LNG	birch_ragnarlocker.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0278882.WMF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SUBMIT.JS	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200183.WMF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0291984.WMF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Module.thmx	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter_partly-cloudy.png	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png	birch_ragnarlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4	birch_ragnarlocker.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

birch_ragnarlocker.exe

description ioc process

File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-2090973689-680783404-4292415065-1000\desktop.ini birch_ragnarlocker.exe
Drops startup file 1 IoCs

Processes:

birch_ragnarlocker.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_AC7AABB2.txt birch_ragnarlocker.exe

description	ioc	process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-2090973689-680783404-4292415065-1000\desktop.ini	birch_ragnarlocker.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_AC7AABB2.txt	birch_ragnarlocker.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

birch_ragnarlocker.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\EnableConfirm.tiff	birch_ragnarlocker.exe
File renamed	C:\Users\Admin\Pictures\EnableConfirm.tiff => C:\Users\Admin\Pictures\EnableConfirm.tiff.ragnar_AC7AABB2	birch_ragnarlocker.exe
File renamed	C:\Users\Admin\Pictures\ReadExpand.raw => C:\Users\Admin\Pictures\ReadExpand.raw.ragnar_AC7AABB2	birch_ragnarlocker.exe
File renamed	C:\Users\Admin\Pictures\SkipRevoke.raw => C:\Users\Admin\Pictures\SkipRevoke.raw.ragnar_AC7AABB2	birch_ragnarlocker.exe
File opened for modification	C:\Users\Admin\Pictures\StopDismount.tiff	birch_ragnarlocker.exe
File renamed	C:\Users\Admin\Pictures\StopDismount.tiff => C:\Users\Admin\Pictures\StopDismount.tiff.ragnar_AC7AABB2	birch_ragnarlocker.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

birch_ragnarlocker.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 birch_ragnarlocker.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	birch_ragnarlocker.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

birch_ragnarlocker.exe

description	pid	process	target process
PID 336 wrote to memory of 1020	336	birch_ragnarlocker.exe	wmic.exe
PID 336 wrote to memory of 1020	336	birch_ragnarlocker.exe	wmic.exe
PID 336 wrote to memory of 1020	336	birch_ragnarlocker.exe	wmic.exe
PID 336 wrote to memory of 1020	336	birch_ragnarlocker.exe	wmic.exe
PID 336 wrote to memory of 828	336	birch_ragnarlocker.exe	vssadmin.exe
PID 336 wrote to memory of 828	336	birch_ragnarlocker.exe	vssadmin.exe
PID 336 wrote to memory of 828	336	birch_ragnarlocker.exe	vssadmin.exe
PID 336 wrote to memory of 828	336	birch_ragnarlocker.exe	vssadmin.exe
PID 336 wrote to memory of 1588	336	birch_ragnarlocker.exe	notepad.exe
PID 336 wrote to memory of 1588	336	birch_ragnarlocker.exe	notepad.exe
PID 336 wrote to memory of 1588	336	birch_ragnarlocker.exe	notepad.exe
PID 336 wrote to memory of 1588	336	birch_ragnarlocker.exe	notepad.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1020	wmic.exe
Token: SeSecurityPrivilege	1020	wmic.exe
Token: SeTakeOwnershipPrivilege	1020	wmic.exe
Token: SeLoadDriverPrivilege	1020	wmic.exe
Token: SeSystemProfilePrivilege	1020	wmic.exe
Token: SeSystemtimePrivilege	1020	wmic.exe
Token: SeProfSingleProcessPrivilege	1020	wmic.exe
Token: SeIncBasePriorityPrivilege	1020	wmic.exe
Token: SeCreatePagefilePrivilege	1020	wmic.exe
Token: SeBackupPrivilege	1020	wmic.exe
Token: SeRestorePrivilege	1020	wmic.exe
Token: SeShutdownPrivilege	1020	wmic.exe
Token: SeDebugPrivilege	1020	wmic.exe
Token: SeSystemEnvironmentPrivilege	1020	wmic.exe
Token: SeRemoteShutdownPrivilege	1020	wmic.exe
Token: SeUndockPrivilege	1020	wmic.exe
Token: SeManageVolumePrivilege	1020	wmic.exe
Token: 33	1020	wmic.exe
Token: 34	1020	wmic.exe
Token: 35	1020	wmic.exe
Token: SeBackupPrivilege	988	vssvc.exe
Token: SeRestorePrivilege	988	vssvc.exe
Token: SeAuditPrivilege	988	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1020	wmic.exe
Token: SeSecurityPrivilege	1020	wmic.exe
Token: SeTakeOwnershipPrivilege	1020	wmic.exe
Token: SeLoadDriverPrivilege	1020	wmic.exe
Token: SeSystemProfilePrivilege	1020	wmic.exe
Token: SeSystemtimePrivilege	1020	wmic.exe
Token: SeProfSingleProcessPrivilege	1020	wmic.exe
Token: SeIncBasePriorityPrivilege	1020	wmic.exe
Token: SeCreatePagefilePrivilege	1020	wmic.exe
Token: SeBackupPrivilege	1020	wmic.exe
Token: SeRestorePrivilege	1020	wmic.exe
Token: SeShutdownPrivilege	1020	wmic.exe
Token: SeDebugPrivilege	1020	wmic.exe
Token: SeSystemEnvironmentPrivilege	1020	wmic.exe
Token: SeRemoteShutdownPrivilege	1020	wmic.exe
Token: SeUndockPrivilege	1020	wmic.exe
Token: SeManageVolumePrivilege	1020	wmic.exe
Token: 33	1020	wmic.exe
Token: 34	1020	wmic.exe
Token: 35	1020	wmic.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

1588 notepad.exe
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker

pid	process
1588	notepad.exe

C:\Users\Admin\AppData\Local\Temp\birch_ragnarlocker.exe
"C:\Users\Admin\AppData\Local\Temp\birch_ragnarlocker.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Drops desktop.ini file(s)
- Drops startup file
- Modifies extensions of user files
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:828
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\RGNR_AC7AABB2.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\RGNR_AC7AABB2.txt

Download Submit
memory/336-37-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-5-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-47-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-9-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-15-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-19-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-23-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-29-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-51-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-0-0x0000000002B40000-0x0000000002B51000-memory.dmp

Filesize
68KB

Download
memory/336-1-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-2-0x0000000002B40000-0x0000000002B51000-memory.dmp

Filesize
68KB

Download
memory/336-33-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-55-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-65-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-75-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-83-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-91-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/336-41-0x0000000002F50000-0x0000000002F61000-memory.dmp

Filesize
68KB

Download
memory/828-101-0x0000000000000000-mapping.dmp

Download
memory/1020-100-0x0000000000000000-mapping.dmp

Download
memory/1588-102-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads