Analysis
-
max time kernel
62s -
max time network
47s -
platform
windows7_x64 -
resource
win7 -
submitted
03-08-2020 10:01
Static task
static1
Behavioral task
behavioral1
Sample
ragnar_locker_VGCARGO.exe
Resource
win7
Behavioral task
behavioral2
Sample
ragnar_locker_VGCARGO.exe
Resource
win10
General
-
Target
ragnar_locker_VGCARGO.exe
-
Size
39KB
-
MD5
7529e3c83618f5e3a4cc6dbf3a8534a6
-
SHA1
0f944504eebfca5466b6113853b0d83e38cf885a
-
SHA256
ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
-
SHA512
7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_F0C1BF83.txt
cargowelcome@protonmail.com
1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4
https://tox.chat/download.html
Signatures
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1300 wmic.exe Token: SeSecurityPrivilege 1300 wmic.exe Token: SeTakeOwnershipPrivilege 1300 wmic.exe Token: SeLoadDriverPrivilege 1300 wmic.exe Token: SeSystemProfilePrivilege 1300 wmic.exe Token: SeSystemtimePrivilege 1300 wmic.exe Token: SeProfSingleProcessPrivilege 1300 wmic.exe Token: SeIncBasePriorityPrivilege 1300 wmic.exe Token: SeCreatePagefilePrivilege 1300 wmic.exe Token: SeBackupPrivilege 1300 wmic.exe Token: SeRestorePrivilege 1300 wmic.exe Token: SeShutdownPrivilege 1300 wmic.exe Token: SeDebugPrivilege 1300 wmic.exe Token: SeSystemEnvironmentPrivilege 1300 wmic.exe Token: SeRemoteShutdownPrivilege 1300 wmic.exe Token: SeUndockPrivilege 1300 wmic.exe Token: SeManageVolumePrivilege 1300 wmic.exe Token: 33 1300 wmic.exe Token: 34 1300 wmic.exe Token: 35 1300 wmic.exe Token: SeBackupPrivilege 288 vssvc.exe Token: SeRestorePrivilege 288 vssvc.exe Token: SeAuditPrivilege 288 vssvc.exe Token: SeIncreaseQuotaPrivilege 1300 wmic.exe Token: SeSecurityPrivilege 1300 wmic.exe Token: SeTakeOwnershipPrivilege 1300 wmic.exe Token: SeLoadDriverPrivilege 1300 wmic.exe Token: SeSystemProfilePrivilege 1300 wmic.exe Token: SeSystemtimePrivilege 1300 wmic.exe Token: SeProfSingleProcessPrivilege 1300 wmic.exe Token: SeIncBasePriorityPrivilege 1300 wmic.exe Token: SeCreatePagefilePrivilege 1300 wmic.exe Token: SeBackupPrivilege 1300 wmic.exe Token: SeRestorePrivilege 1300 wmic.exe Token: SeShutdownPrivilege 1300 wmic.exe Token: SeDebugPrivilege 1300 wmic.exe Token: SeSystemEnvironmentPrivilege 1300 wmic.exe Token: SeRemoteShutdownPrivilege 1300 wmic.exe Token: SeUndockPrivilege 1300 wmic.exe Token: SeManageVolumePrivilege 1300 wmic.exe Token: 33 1300 wmic.exe Token: 34 1300 wmic.exe Token: 35 1300 wmic.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1476 vssadmin.exe -
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Drops startup file 1 IoCs
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1780 notepad.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ragnar_locker_VGCARGO.exedescription pid process target process PID 892 wrote to memory of 1300 892 ragnar_locker_VGCARGO.exe wmic.exe PID 892 wrote to memory of 1300 892 ragnar_locker_VGCARGO.exe wmic.exe PID 892 wrote to memory of 1300 892 ragnar_locker_VGCARGO.exe wmic.exe PID 892 wrote to memory of 1300 892 ragnar_locker_VGCARGO.exe wmic.exe PID 892 wrote to memory of 1476 892 ragnar_locker_VGCARGO.exe vssadmin.exe PID 892 wrote to memory of 1476 892 ragnar_locker_VGCARGO.exe vssadmin.exe PID 892 wrote to memory of 1476 892 ragnar_locker_VGCARGO.exe vssadmin.exe PID 892 wrote to memory of 1476 892 ragnar_locker_VGCARGO.exe vssadmin.exe PID 892 wrote to memory of 1780 892 ragnar_locker_VGCARGO.exe notepad.exe PID 892 wrote to memory of 1780 892 ragnar_locker_VGCARGO.exe notepad.exe PID 892 wrote to memory of 1780 892 ragnar_locker_VGCARGO.exe notepad.exe PID 892 wrote to memory of 1780 892 ragnar_locker_VGCARGO.exe notepad.exe -
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File renamed C:\Users\Admin\Pictures\ReadSend.tif => C:\Users\Admin\Pictures\ReadSend.tif.ragnar_F0C1BF83 ragnar_locker_VGCARGO.exe File renamed C:\Users\Admin\Pictures\RegisterRedo.crw => C:\Users\Admin\Pictures\RegisterRedo.crw.ragnar_F0C1BF83 ragnar_locker_VGCARGO.exe File renamed C:\Users\Admin\Pictures\RestoreOut.raw => C:\Users\Admin\Pictures\RestoreOut.raw.ragnar_F0C1BF83 ragnar_locker_VGCARGO.exe File renamed C:\Users\Admin\Pictures\ExpandRedo.crw => C:\Users\Admin\Pictures\ExpandRedo.crw.ragnar_F0C1BF83 ragnar_locker_VGCARGO.exe -
Drops file in Program Files directory 10166 IoCs
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe ragnar_locker_VGCARGO.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Tags.accft ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\service.js ragnar_locker_VGCARGO.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.DPV ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL104.XML ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\micaut.dll.mui ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\CONCRETE.ELM ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Niue ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DISTLSTL.ICO ragnar_locker_VGCARGO.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF ragnar_locker_VGCARGO.exe File created C:\Program Files\WindowsPowerShell\Configuration\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-3.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST5EDT ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.OPG ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.VN.XML ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0251007.WMF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART4.BDR ragnar_locker_VGCARGO.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\PYCC.pf ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\FONTSCHM.INI ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME44.CSS ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin ragnar_locker_VGCARGO.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RGNR_F0C1BF83.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EET ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_OFF.GIF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\LAYERS.ELM ragnar_locker_VGCARGO.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 ragnar_locker_VGCARGO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ragnar_locker_VGCARGO.exe"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_VGCARGO.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
- Drops file in Program Files directory
- Writes to the Master Boot Record (MBR)
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_F0C1BF83.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service