ragnarlocker | 63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059

General

Target

ragnar_locker_WEGLARZCO.bin.exe
Size

42KB
MD5

0fbbc59d4fe280a55c1fb6f5502c1e73
SHA1

af53890ed1d4753e7493d48862bdd7d18a2b11f6
SHA256

63096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059
SHA512

20b87ac354cefa2b75e8edbe30b903c51e4f2c2cb49f59dd40732d964612a69b149cb10274feab5c6971c8adfc91fba11f1ebeba38e1b2d45c6b1b4d3dd37633

Score

10^/10

ransomware persistence bootkit ragnarlocker

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_F0C1BF83.txt

Family

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO WEGLARZCO! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Reinstall your OS DO NOT Delete readme files ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special DECRYPTION key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities. Don't waste your TIME, the link for contacting us will be deleted in closest future if there is no contact made and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! а) Download and install TOR browser from this site : https://torproject.org b) Open our website : http://mykgoj7uvqtgl367.onion/client/?61bcbDc31F1c894054C3B84aF53C35cF3005e1A69366A6e857a5a4fd60fb7184 c) If Tor is restricted in your area, use VPN Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---RAGNAR SECRET--- NjFiY2JEYzMxRjFjODk0MDU0QzNCODRhRjUzQzM1Y0YzMDA1ZTFBNjkzNjZBNmU4NTdhNWE0ZmQ2MGZiNzE4NA== ---RAGNAR SECRET--- ***********************************************************************************

URLs

http://mykgoj7uvqtgl367.onion/client/?61bcbDc31F1c894054C3B84aF53C35cF3005e1A69366A6e857a5a4fd60fb7184

Signatures

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ragnar_locker_WEGLARZCO.bin.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\DenyJoin.tif => C:\Users\Admin\Pictures\DenyJoin.tif.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\DismountEdit.tiff => C:\Users\Admin\Pictures\DismountEdit.tiff.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\InstallNew.crw => C:\Users\Admin\Pictures\InstallNew.crw.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\InvokeMeasure.tif => C:\Users\Admin\Pictures\InvokeMeasure.tif.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\OutComplete.tif => C:\Users\Admin\Pictures\OutComplete.tif.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\PushDeny.crw => C:\Users\Admin\Pictures\PushDeny.crw.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\RestartReset.crw => C:\Users\Admin\Pictures\RestartReset.crw.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\AssertDisable.tif => C:\Users\Admin\Pictures\AssertDisable.tif.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File renamed	C:\Users\Admin\Pictures\DisconnectEdit.raw => C:\Users\Admin\Pictures\DisconnectEdit.raw.ragnar_F0C1BF83	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Users\Admin\Pictures\DismountEdit.tiff	ragnar_locker_WEGLARZCO.bin.exe

Drops startup file 1 IoCs

Processes:

ragnar_locker_WEGLARZCO.bin.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_F0C1BF83.txt ragnar_locker_WEGLARZCO.bin.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1944 vssadmin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_F0C1BF83.txt	ragnar_locker_WEGLARZCO.bin.exe

pid	process
1944	vssadmin.exe

Drops file in Program Files directory 10149 IoCs

Processes:

ragnar_locker_WEGLARZCO.bin.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0304875.WMF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR40F.GIF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\INCOMING.ICO	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105388.WMF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\drag.png	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0174315.WMF	ragnar_locker_WEGLARZCO.bin.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\RGNR_F0C1BF83.txt	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\PREVIEW.GIF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01793_.WMF	ragnar_locker_WEGLARZCO.bin.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\RGNR_F0C1BF83.txt	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.png	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\POSTCD98.POC	ragnar_locker_WEGLARZCO.bin.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\RGNR_F0C1BF83.txt	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MsMpRes.dll.mui	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PAGESIZE\PG_INDEX.XML	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB5A.BDR	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\New_Skins.url	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Black Tie.xml	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\background.gif	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui	ragnar_locker_WEGLARZCO.bin.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RGNR_F0C1BF83.txt	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0313896.JPG	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK_COL.HXT	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02384_.WMF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTS.ICO	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143750.GIF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0240695.WMF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\STRTEDGE.ELM	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\meta-index	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0237228.WMF	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_italic.gif	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\PICTPH.POC	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo	ragnar_locker_WEGLARZCO.bin.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF	ragnar_locker_WEGLARZCO.bin.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

ragnar_locker_WEGLARZCO.bin.exe

pid	process
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe
1456	ragnar_locker_WEGLARZCO.bin.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ragnar_locker_WEGLARZCO.bin.exe

description	pid	process	target process
PID 1456 wrote to memory of 1932	1456	ragnar_locker_WEGLARZCO.bin.exe	wmic.exe
PID 1456 wrote to memory of 1932	1456	ragnar_locker_WEGLARZCO.bin.exe	wmic.exe
PID 1456 wrote to memory of 1932	1456	ragnar_locker_WEGLARZCO.bin.exe	wmic.exe
PID 1456 wrote to memory of 1932	1456	ragnar_locker_WEGLARZCO.bin.exe	wmic.exe
PID 1456 wrote to memory of 1944	1456	ragnar_locker_WEGLARZCO.bin.exe	vssadmin.exe
PID 1456 wrote to memory of 1944	1456	ragnar_locker_WEGLARZCO.bin.exe	vssadmin.exe
PID 1456 wrote to memory of 1944	1456	ragnar_locker_WEGLARZCO.bin.exe	vssadmin.exe
PID 1456 wrote to memory of 1944	1456	ragnar_locker_WEGLARZCO.bin.exe	vssadmin.exe
PID 1456 wrote to memory of 804	1456	ragnar_locker_WEGLARZCO.bin.exe	notepad.exe
PID 1456 wrote to memory of 804	1456	ragnar_locker_WEGLARZCO.bin.exe	notepad.exe
PID 1456 wrote to memory of 804	1456	ragnar_locker_WEGLARZCO.bin.exe	notepad.exe
PID 1456 wrote to memory of 804	1456	ragnar_locker_WEGLARZCO.bin.exe	notepad.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1932	wmic.exe
Token: SeSecurityPrivilege	1932	wmic.exe
Token: SeTakeOwnershipPrivilege	1932	wmic.exe
Token: SeLoadDriverPrivilege	1932	wmic.exe
Token: SeSystemProfilePrivilege	1932	wmic.exe
Token: SeSystemtimePrivilege	1932	wmic.exe
Token: SeProfSingleProcessPrivilege	1932	wmic.exe
Token: SeIncBasePriorityPrivilege	1932	wmic.exe
Token: SeCreatePagefilePrivilege	1932	wmic.exe
Token: SeBackupPrivilege	1932	wmic.exe
Token: SeRestorePrivilege	1932	wmic.exe
Token: SeShutdownPrivilege	1932	wmic.exe
Token: SeDebugPrivilege	1932	wmic.exe
Token: SeSystemEnvironmentPrivilege	1932	wmic.exe
Token: SeRemoteShutdownPrivilege	1932	wmic.exe
Token: SeUndockPrivilege	1932	wmic.exe
Token: SeManageVolumePrivilege	1932	wmic.exe
Token: 33	1932	wmic.exe
Token: 34	1932	wmic.exe
Token: 35	1932	wmic.exe
Token: SeIncreaseQuotaPrivilege	1932	wmic.exe
Token: SeSecurityPrivilege	1932	wmic.exe
Token: SeTakeOwnershipPrivilege	1932	wmic.exe
Token: SeLoadDriverPrivilege	1932	wmic.exe
Token: SeSystemProfilePrivilege	1932	wmic.exe
Token: SeSystemtimePrivilege	1932	wmic.exe
Token: SeProfSingleProcessPrivilege	1932	wmic.exe
Token: SeIncBasePriorityPrivilege	1932	wmic.exe
Token: SeCreatePagefilePrivilege	1932	wmic.exe
Token: SeBackupPrivilege	1932	wmic.exe
Token: SeRestorePrivilege	1932	wmic.exe
Token: SeShutdownPrivilege	1932	wmic.exe
Token: SeDebugPrivilege	1932	wmic.exe
Token: SeSystemEnvironmentPrivilege	1932	wmic.exe
Token: SeRemoteShutdownPrivilege	1932	wmic.exe
Token: SeUndockPrivilege	1932	wmic.exe
Token: SeManageVolumePrivilege	1932	wmic.exe
Token: 33	1932	wmic.exe
Token: 34	1932	wmic.exe
Token: 35	1932	wmic.exe
Token: SeBackupPrivilege	1980	vssvc.exe
Token: SeRestorePrivilege	1980	vssvc.exe
Token: SeAuditPrivilege	1980	vssvc.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

804 notepad.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

ragnar_locker_WEGLARZCO.bin.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 ragnar_locker_WEGLARZCO.bin.exe
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker

pid	process
804	notepad.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	ragnar_locker_WEGLARZCO.bin.exe

C:\Users\Admin\AppData\Local\Temp\ragnar_locker_WEGLARZCO.bin.exe
"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_WEGLARZCO.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Writes to the Master Boot Record (MBR)
PID:1456
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1944
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\RGNR_F0C1BF83.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\RGNR_F0C1BF83.txt

Download Submit
memory/804-76-0x0000000000000000-mapping.dmp

Download
memory/1456-41-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-5-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-45-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-9-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-15-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-19-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-23-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-27-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-47-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-37-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-1-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-3-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-31-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-49-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-53-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-57-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-61-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-67-0x0000000002700000-0x0000000002711000-memory.dmp

Filesize
68KB

Download
memory/1456-0-0x0000000000D50000-0x0000000000D61000-memory.dmp

Filesize
68KB

Download
memory/1456-2-0x0000000000D50000-0x0000000000D61000-memory.dmp

Filesize
68KB

Download
memory/1932-74-0x0000000000000000-mapping.dmp

Download
memory/1944-75-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads