Analysis
-
max time kernel
66s -
max time network
63s -
platform
windows10_x64 -
resource
win10 -
submitted
03-08-2020 10:01
Static task
static1
Behavioral task
behavioral1
Sample
ragnar_locker_VGCARGO.exe
Resource
win7
Behavioral task
behavioral2
Sample
ragnar_locker_VGCARGO.exe
Resource
win10
General
-
Target
ragnar_locker_VGCARGO.exe
-
Size
39KB
-
MD5
7529e3c83618f5e3a4cc6dbf3a8534a6
-
SHA1
0f944504eebfca5466b6113853b0d83e38cf885a
-
SHA256
ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
-
SHA512
7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_2D08E9B5.txt
cargowelcome@protonmail.com
1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4
https://tox.chat/download.html
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
ragnar_locker_VGCARGO.exedescription pid process target process PID 3104 wrote to memory of 2488 3104 ragnar_locker_VGCARGO.exe wmic.exe PID 3104 wrote to memory of 2488 3104 ragnar_locker_VGCARGO.exe wmic.exe PID 3104 wrote to memory of 1692 3104 ragnar_locker_VGCARGO.exe vssadmin.exe PID 3104 wrote to memory of 1692 3104 ragnar_locker_VGCARGO.exe vssadmin.exe PID 3104 wrote to memory of 3696 3104 ragnar_locker_VGCARGO.exe notepad.exe PID 3104 wrote to memory of 3696 3104 ragnar_locker_VGCARGO.exe notepad.exe PID 3104 wrote to memory of 3696 3104 ragnar_locker_VGCARGO.exe notepad.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 3696 notepad.exe -
Drops file in Program Files directory 19490 IoCs
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Density_Hollow.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\logo.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-20_altform-unplated.png ragnar_locker_VGCARGO.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageProviderFunctions.psm1 ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\settle.scale-180.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\_Resources\index.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\se_60x42.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\ui-strings.js ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\visualvm.conf ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-125_contrast-high.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\OneConnectMedTile.scale-125.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml ragnar_locker_VGCARGO.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-200.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\StarClub\new_collection_available.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\mask_corners_king.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\3569_40x40x32.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-1.jpg ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-100.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit@3x.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\GameDVRValueProp.png ragnar_locker_VGCARGO.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-high.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\de-DE.PhoneNumber.SMS.ot ragnar_locker_VGCARGO.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-96.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5666_24x24x32.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\ui-strings.js ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\Handler@1x.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-2x.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\Xusage.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\AppxSignature.p7x ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\NIRMALA.TTF ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-400.png ragnar_locker_VGCARGO.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF ragnar_locker_VGCARGO.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\AppxSignature.p7x ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\OneConnectSplashScreen.scale-100.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-48_altform-unplated.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunpkcs11.jar ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms ragnar_locker_VGCARGO.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\card_shadow_big.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60.png ragnar_locker_VGCARGO.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\Sounds\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.contrast-black_scale-100.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms ragnar_locker_VGCARGO.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-150.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_24.svg ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30.png ragnar_locker_VGCARGO.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner.png ragnar_locker_VGCARGO.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 ragnar_locker_VGCARGO.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1692 vssadmin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2488 wmic.exe Token: SeSecurityPrivilege 2488 wmic.exe Token: SeTakeOwnershipPrivilege 2488 wmic.exe Token: SeLoadDriverPrivilege 2488 wmic.exe Token: SeSystemProfilePrivilege 2488 wmic.exe Token: SeSystemtimePrivilege 2488 wmic.exe Token: SeProfSingleProcessPrivilege 2488 wmic.exe Token: SeIncBasePriorityPrivilege 2488 wmic.exe Token: SeCreatePagefilePrivilege 2488 wmic.exe Token: SeBackupPrivilege 2488 wmic.exe Token: SeRestorePrivilege 2488 wmic.exe Token: SeShutdownPrivilege 2488 wmic.exe Token: SeDebugPrivilege 2488 wmic.exe Token: SeSystemEnvironmentPrivilege 2488 wmic.exe Token: SeRemoteShutdownPrivilege 2488 wmic.exe Token: SeUndockPrivilege 2488 wmic.exe Token: SeManageVolumePrivilege 2488 wmic.exe Token: 33 2488 wmic.exe Token: 34 2488 wmic.exe Token: 35 2488 wmic.exe Token: 36 2488 wmic.exe Token: SeBackupPrivilege 404 vssvc.exe Token: SeRestorePrivilege 404 vssvc.exe Token: SeAuditPrivilege 404 vssvc.exe Token: SeIncreaseQuotaPrivilege 2488 wmic.exe Token: SeSecurityPrivilege 2488 wmic.exe Token: SeTakeOwnershipPrivilege 2488 wmic.exe Token: SeLoadDriverPrivilege 2488 wmic.exe Token: SeSystemProfilePrivilege 2488 wmic.exe Token: SeSystemtimePrivilege 2488 wmic.exe Token: SeProfSingleProcessPrivilege 2488 wmic.exe Token: SeIncBasePriorityPrivilege 2488 wmic.exe Token: SeCreatePagefilePrivilege 2488 wmic.exe Token: SeBackupPrivilege 2488 wmic.exe Token: SeRestorePrivilege 2488 wmic.exe Token: SeShutdownPrivilege 2488 wmic.exe Token: SeDebugPrivilege 2488 wmic.exe Token: SeSystemEnvironmentPrivilege 2488 wmic.exe Token: SeRemoteShutdownPrivilege 2488 wmic.exe Token: SeUndockPrivilege 2488 wmic.exe Token: SeManageVolumePrivilege 2488 wmic.exe Token: 33 2488 wmic.exe Token: 34 2488 wmic.exe Token: 35 2488 wmic.exe Token: 36 2488 wmic.exe -
Drops startup file 1 IoCs
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_2D08E9B5.txt ragnar_locker_VGCARGO.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ragnar_locker_VGCARGO.exedescription ioc process File renamed C:\Users\Admin\Pictures\ProtectUnblock.tiff => C:\Users\Admin\Pictures\ProtectUnblock.tiff.ragnar_2D08E9B5 ragnar_locker_VGCARGO.exe File renamed C:\Users\Admin\Pictures\StartFormat.crw => C:\Users\Admin\Pictures\StartFormat.crw.ragnar_2D08E9B5 ragnar_locker_VGCARGO.exe File renamed C:\Users\Admin\Pictures\SuspendGet.tif => C:\Users\Admin\Pictures\SuspendGet.tif.ragnar_2D08E9B5 ragnar_locker_VGCARGO.exe File renamed C:\Users\Admin\Pictures\SwitchReset.png => C:\Users\Admin\Pictures\SwitchReset.png.ragnar_2D08E9B5 ragnar_locker_VGCARGO.exe File renamed C:\Users\Admin\Pictures\WriteProtect.tif => C:\Users\Admin\Pictures\WriteProtect.tif.ragnar_2D08E9B5 ragnar_locker_VGCARGO.exe File opened for modification C:\Users\Admin\Pictures\ProtectUnblock.tiff ragnar_locker_VGCARGO.exe -
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ragnar_locker_VGCARGO.exe"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_VGCARGO.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Writes to the Master Boot Record (MBR)
- Drops startup file
- Modifies extensions of user files
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_2D08E9B5.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken