ragnarlocker | dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4

General

Target

ragnar_locker_GST_AutoLeather.exe
Size

48KB
MD5

1ee5456c1226affd7b72bcdf3db443b7
SHA1

e22344a92c91b567a6cba7eb66686c438d479462
SHA256

dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4
SHA512

326e647615cab28c2a9e065ad628059b739d207a319c6631f9ed57a97548c67565c096d7227a6dc880484b65013977e95dd25e3ec8258c5e43c4567f0d86af00

Score

10^/10

ransomware bootkit persistence ragnarlocker

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_AC7AABB2.txt

Family

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO GST_AutoLeather ! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Shutdown or reset your system ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special decryption key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities Don't waste your TIME, the link for contacting us will be deleted if there is no contact made in closest future and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. WARNING ! We had downloaded more than 1TB of your private information including billing info, clients private data, contracts, agreements and a lot of other sensitive information. Also we get everything from such files as "topsecret.doc" where was an access to your's SQL databases, Sharepoints, Barracuda Backups, Admin credentials and other services. You can check some proofs here: https://prnt.sc/s1xrct https://prnt.sc/s1xrpe https://prnt.sc/s1xs5s https://prnt.sc/s1xt9j Whole data gathered from your SECRET files and directories could be published for everyone's view and your partners, clients and investors would be notified about leak. However if we make a deal everything would be kept in secret and all your data will be restored. You can take a look on some examples of what we have, right now it's a private hidden page. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/in-project-temporarypage-18-04/ to view the page's content use password: leather9912gst013 ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://stppd5as5x4hxs45.onion/client/?1cdCAFdD70D2Eb1E078BCDED49fAb75d6315592715f319aFcb3c6106eFda88a2 c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/in-project-temporarypage-18-04/ ( password: leather9912gst013 ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---RAGNAR SECRET--- MWNkQ0FGZEQ3MEQyRWIxRTA3OEJDREVENDlmQWI3NWQ2MzE1NTkyNzE1ZjMxOWFGY2IzYzYxMDZlRmRhODhhMg== ---RAGNAR SECRET--- ***********************************************************************************

URLs

https://prnt.sc/s1xrct

https://prnt.sc/s1xrpe

https://prnt.sc/s1xs5s

https://prnt.sc/s1xt9j

http://p6o7m73ujalhgkiv.onion/in-project-temporarypage-18-04/

http://stppd5as5x4hxs45.onion/client/?1cdCAFdD70D2Eb1E078BCDED49fAb75d6315592715f319aFcb3c6106eFda88a2

Signatures

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1948	wmic.exe
Token: SeSecurityPrivilege	1948	wmic.exe
Token: SeTakeOwnershipPrivilege	1948	wmic.exe
Token: SeLoadDriverPrivilege	1948	wmic.exe
Token: SeSystemProfilePrivilege	1948	wmic.exe
Token: SeSystemtimePrivilege	1948	wmic.exe
Token: SeProfSingleProcessPrivilege	1948	wmic.exe
Token: SeIncBasePriorityPrivilege	1948	wmic.exe
Token: SeCreatePagefilePrivilege	1948	wmic.exe
Token: SeBackupPrivilege	1948	wmic.exe
Token: SeRestorePrivilege	1948	wmic.exe
Token: SeShutdownPrivilege	1948	wmic.exe
Token: SeDebugPrivilege	1948	wmic.exe
Token: SeSystemEnvironmentPrivilege	1948	wmic.exe
Token: SeRemoteShutdownPrivilege	1948	wmic.exe
Token: SeUndockPrivilege	1948	wmic.exe
Token: SeManageVolumePrivilege	1948	wmic.exe
Token: 33	1948	wmic.exe
Token: 34	1948	wmic.exe
Token: 35	1948	wmic.exe
Token: SeBackupPrivilege	1996	vssvc.exe
Token: SeRestorePrivilege	1996	vssvc.exe
Token: SeAuditPrivilege	1996	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1948	wmic.exe
Token: SeSecurityPrivilege	1948	wmic.exe
Token: SeTakeOwnershipPrivilege	1948	wmic.exe
Token: SeLoadDriverPrivilege	1948	wmic.exe
Token: SeSystemProfilePrivilege	1948	wmic.exe
Token: SeSystemtimePrivilege	1948	wmic.exe
Token: SeProfSingleProcessPrivilege	1948	wmic.exe
Token: SeIncBasePriorityPrivilege	1948	wmic.exe
Token: SeCreatePagefilePrivilege	1948	wmic.exe
Token: SeBackupPrivilege	1948	wmic.exe
Token: SeRestorePrivilege	1948	wmic.exe
Token: SeShutdownPrivilege	1948	wmic.exe
Token: SeDebugPrivilege	1948	wmic.exe
Token: SeSystemEnvironmentPrivilege	1948	wmic.exe
Token: SeRemoteShutdownPrivilege	1948	wmic.exe
Token: SeUndockPrivilege	1948	wmic.exe
Token: SeManageVolumePrivilege	1948	wmic.exe
Token: 33	1948	wmic.exe
Token: 34	1948	wmic.exe
Token: 35	1948	wmic.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

ragnar_locker_GST_AutoLeather.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 ragnar_locker_GST_AutoLeather.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	ragnar_locker_GST_AutoLeather.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

944 notepad.exe

pid	process
944	notepad.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ragnar_locker_GST_AutoLeather.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\JoinDebug.crw => C:\Users\Admin\Pictures\JoinDebug.crw.ragnar_AC7AABB2	ragnar_locker_GST_AutoLeather.exe
File renamed	C:\Users\Admin\Pictures\LockBackup.raw => C:\Users\Admin\Pictures\LockBackup.raw.ragnar_AC7AABB2	ragnar_locker_GST_AutoLeather.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

ragnar_locker_GST_AutoLeather.exe

pid	process
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe
1000	ragnar_locker_GST_AutoLeather.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ragnar_locker_GST_AutoLeather.exe

description	pid	process	target process
PID 1000 wrote to memory of 1948	1000	ragnar_locker_GST_AutoLeather.exe	wmic.exe
PID 1000 wrote to memory of 1948	1000	ragnar_locker_GST_AutoLeather.exe	wmic.exe
PID 1000 wrote to memory of 1948	1000	ragnar_locker_GST_AutoLeather.exe	wmic.exe
PID 1000 wrote to memory of 1948	1000	ragnar_locker_GST_AutoLeather.exe	wmic.exe
PID 1000 wrote to memory of 1936	1000	ragnar_locker_GST_AutoLeather.exe	vssadmin.exe
PID 1000 wrote to memory of 1936	1000	ragnar_locker_GST_AutoLeather.exe	vssadmin.exe
PID 1000 wrote to memory of 1936	1000	ragnar_locker_GST_AutoLeather.exe	vssadmin.exe
PID 1000 wrote to memory of 1936	1000	ragnar_locker_GST_AutoLeather.exe	vssadmin.exe
PID 1000 wrote to memory of 944	1000	ragnar_locker_GST_AutoLeather.exe	notepad.exe
PID 1000 wrote to memory of 944	1000	ragnar_locker_GST_AutoLeather.exe	notepad.exe
PID 1000 wrote to memory of 944	1000	ragnar_locker_GST_AutoLeather.exe	notepad.exe
PID 1000 wrote to memory of 944	1000	ragnar_locker_GST_AutoLeather.exe	notepad.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1936 vssadmin.exe

pid	process
1936	vssadmin.exe

Drops file in Program Files directory 10158 IoCs

Processes:

ragnar_locker_GST_AutoLeather.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0229385.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01040_.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21331_.GIF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32B.GIF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBEMAIL.POC	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Major Indicies.iqy	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199475.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00006_.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21325_.GIF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Stationery\1033\NOTEBOOK.JPG	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Name.accft	ragnar_locker_GST_AutoLeather.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MEDIA\WHOOSH.WAV	ragnar_locker_GST_AutoLeather.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\THMBNAIL.PNG	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01361_.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\SLATE.ELM	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CACH.LEX	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01299_.GIF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18190_.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\CONVERT\ODBC.SAM	ragnar_locker_GST_AutoLeather.exe
File created	C:\Program Files (x86)\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\settings.css	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWS.XML	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_settings.png	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bogota	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0282932.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL026.XML	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\REMINDER.WAV	ragnar_locker_GST_AutoLeather.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\RES98.POC	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR28F.GIF	ragnar_locker_GST_AutoLeather.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe
File created	C:\Program Files\Windows Journal\en-US\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01575_.WMF	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\SETLANG_COL.HXT	ragnar_locker_GST_AutoLeather.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_italic.gif	ragnar_locker_GST_AutoLeather.exe

Drops startup file 1 IoCs

Processes:

ragnar_locker_GST_AutoLeather.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_AC7AABB2.txt ragnar_locker_GST_AutoLeather.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_AC7AABB2.txt	ragnar_locker_GST_AutoLeather.exe

C:\Users\Admin\AppData\Local\Temp\ragnar_locker_GST_AutoLeather.exe
"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_GST_AutoLeather.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Drops startup file
PID:1000
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1936
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\RGNR_AC7AABB2.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\RGNR_AC7AABB2.txt

Download Submit
memory/944-102-0x0000000000000000-mapping.dmp

Download
memory/1000-41-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-69-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-5-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-7-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-9-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-15-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-19-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-23-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-29-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-31-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-33-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-37-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-1-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-0-0x00000000025F0000-0x0000000002601000-memory.dmp

Filesize
68KB

Download
memory/1000-65-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-51-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-55-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-61-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-49-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-3-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-79-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-87-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-89-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-97-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1000-2-0x00000000025F0000-0x0000000002601000-memory.dmp

Filesize
68KB

Download
memory/1000-47-0x0000000002A00000-0x0000000002A11000-memory.dmp

Filesize
68KB

Download
memory/1936-101-0x0000000000000000-mapping.dmp

Download
memory/1948-100-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads