ragnarlocker | 9bdd7f965d1c67396afb0a84c78b4d12118ff377db7efdca4a1340933120f376

General

Target

ragnar_locker_PSE_CREDIT_UNION.exe
Size

39KB
MD5

6171000983cf3896d167e0d8aa9b94ba
SHA1

b155264bbfbad7226b5eb3be2ab38c3ecd9f3e18
SHA256

9bdd7f965d1c67396afb0a84c78b4d12118ff377db7efdca4a1340933120f376
SHA512

1b10008d5eaeb3755c899334d416e8d0a30695e093dc597b21e630fd8bde4b9c5d808fd2663f1acd7489e33b947660dacdb80f7f3aa4911cd24d605cfc44e73a

Score

10^/10

ransomware bootkit persistence ragnarlocker

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_2D08E9B5.txt

Ransom Note

Hello PSE_CREDIT_UNION ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU Amount to pay (in Bitcoin): 60 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- MmE2RjY2N2YwNUZlYmRERjNhZGY4MWY0Y0NiMUEwNEIwRkYyQUZhNDE5QjEwNzYzODhGZjE2QWM5ZGFEYzEwYg== ---RAGNAR SECRET--- ***********************************************************************************

Emails

[email protected]

Wallets

1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU

URLs

https://tox.chat/download.html

Signatures

Drops startup file 1 IoCs

Processes:

ragnar_locker_PSE_CREDIT_UNION.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_2D08E9B5.txt ragnar_locker_PSE_CREDIT_UNION.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

1572 notepad.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe

pid	process
1572	notepad.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker

Drops file in Program Files directory 19487 IoCs

Processes:

ragnar_locker_PSE_CREDIT_UNION.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\mask\12s.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteReplayCrossHairIcon-1.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\SmallTile.scale-100.png	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\RMNSQUE.INF	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-200_contrast-black.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-48_altform-unplated.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\drunk.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\platform_format.lua	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_de_135x40.svg	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Common\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\InModuleScope.Tests.ps1	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-400.png	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-30_altform-unplated.png	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\OneConnectAppList.targetsize-48.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-64_altform-unplated.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Sounds\SpeedLimitViolationAlert.wav	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_contrast-white.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\resources.pri	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1937_32x32x32.png	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-40.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7260_40x40x32.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSplashScreen.scale-100_contrast-black.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\cardsLoadingSequence.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-150.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.jpg	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\326_48x48x32.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-100.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\OneConnectSmallTile.scale-125.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\bw_16x11.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\WideTile.scale-200.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Autumn\autumn_13s.png	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Speech\en-US\tokens_enUS.xml	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js	ragnar_locker_PSE_CREDIT_UNION.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\RGNR_2D08E9B5.txt	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat	ragnar_locker_PSE_CREDIT_UNION.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ragnar_locker_PSE_CREDIT_UNION.exe

description	pid	process	target process
PID 3808 wrote to memory of 416	3808	ragnar_locker_PSE_CREDIT_UNION.exe	wmic.exe
PID 3808 wrote to memory of 416	3808	ragnar_locker_PSE_CREDIT_UNION.exe	wmic.exe
PID 3808 wrote to memory of 508	3808	ragnar_locker_PSE_CREDIT_UNION.exe	vssadmin.exe
PID 3808 wrote to memory of 508	3808	ragnar_locker_PSE_CREDIT_UNION.exe	vssadmin.exe
PID 3808 wrote to memory of 1572	3808	ragnar_locker_PSE_CREDIT_UNION.exe	notepad.exe
PID 3808 wrote to memory of 1572	3808	ragnar_locker_PSE_CREDIT_UNION.exe	notepad.exe
PID 3808 wrote to memory of 1572	3808	ragnar_locker_PSE_CREDIT_UNION.exe	notepad.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

508 vssadmin.exe

pid	process
508	vssadmin.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ragnar_locker_PSE_CREDIT_UNION.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RepairApprove.crw => C:\Users\Admin\Pictures\RepairApprove.crw.ragnar_2D08E9B5	ragnar_locker_PSE_CREDIT_UNION.exe
File opened for modification	C:\Users\Admin\Pictures\BackupShow.tiff	ragnar_locker_PSE_CREDIT_UNION.exe
File renamed	C:\Users\Admin\Pictures\BackupShow.tiff => C:\Users\Admin\Pictures\BackupShow.tiff.ragnar_2D08E9B5	ragnar_locker_PSE_CREDIT_UNION.exe
File renamed	C:\Users\Admin\Pictures\ConnectBlock.png => C:\Users\Admin\Pictures\ConnectBlock.png.ragnar_2D08E9B5	ragnar_locker_PSE_CREDIT_UNION.exe
File renamed	C:\Users\Admin\Pictures\InvokeRedo.crw => C:\Users\Admin\Pictures\InvokeRedo.crw.ragnar_2D08E9B5	ragnar_locker_PSE_CREDIT_UNION.exe
File renamed	C:\Users\Admin\Pictures\MoveCheckpoint.tif => C:\Users\Admin\Pictures\MoveCheckpoint.tif.ragnar_2D08E9B5	ragnar_locker_PSE_CREDIT_UNION.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	416	wmic.exe
Token: SeSecurityPrivilege	416	wmic.exe
Token: SeTakeOwnershipPrivilege	416	wmic.exe
Token: SeLoadDriverPrivilege	416	wmic.exe
Token: SeSystemProfilePrivilege	416	wmic.exe
Token: SeSystemtimePrivilege	416	wmic.exe
Token: SeProfSingleProcessPrivilege	416	wmic.exe
Token: SeIncBasePriorityPrivilege	416	wmic.exe
Token: SeCreatePagefilePrivilege	416	wmic.exe
Token: SeBackupPrivilege	416	wmic.exe
Token: SeRestorePrivilege	416	wmic.exe
Token: SeShutdownPrivilege	416	wmic.exe
Token: SeDebugPrivilege	416	wmic.exe
Token: SeSystemEnvironmentPrivilege	416	wmic.exe
Token: SeRemoteShutdownPrivilege	416	wmic.exe
Token: SeUndockPrivilege	416	wmic.exe
Token: SeManageVolumePrivilege	416	wmic.exe
Token: 33	416	wmic.exe
Token: 34	416	wmic.exe
Token: 35	416	wmic.exe
Token: 36	416	wmic.exe
Token: SeBackupPrivilege	356	vssvc.exe
Token: SeRestorePrivilege	356	vssvc.exe
Token: SeAuditPrivilege	356	vssvc.exe
Token: SeIncreaseQuotaPrivilege	416	wmic.exe
Token: SeSecurityPrivilege	416	wmic.exe
Token: SeTakeOwnershipPrivilege	416	wmic.exe
Token: SeLoadDriverPrivilege	416	wmic.exe
Token: SeSystemProfilePrivilege	416	wmic.exe
Token: SeSystemtimePrivilege	416	wmic.exe
Token: SeProfSingleProcessPrivilege	416	wmic.exe
Token: SeIncBasePriorityPrivilege	416	wmic.exe
Token: SeCreatePagefilePrivilege	416	wmic.exe
Token: SeBackupPrivilege	416	wmic.exe
Token: SeRestorePrivilege	416	wmic.exe
Token: SeShutdownPrivilege	416	wmic.exe
Token: SeDebugPrivilege	416	wmic.exe
Token: SeSystemEnvironmentPrivilege	416	wmic.exe
Token: SeRemoteShutdownPrivilege	416	wmic.exe
Token: SeUndockPrivilege	416	wmic.exe
Token: SeManageVolumePrivilege	416	wmic.exe
Token: 33	416	wmic.exe
Token: 34	416	wmic.exe
Token: 35	416	wmic.exe
Token: 36	416	wmic.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

ragnar_locker_PSE_CREDIT_UNION.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 ragnar_locker_PSE_CREDIT_UNION.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	ragnar_locker_PSE_CREDIT_UNION.exe

C:\Users\Admin\AppData\Local\Temp\ragnar_locker_PSE_CREDIT_UNION.exe
"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_PSE_CREDIT_UNION.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
- Writes to the Master Boot Record (MBR)
PID:3808
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:416
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:508
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\RGNR_2D08E9B5.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1572