ragnarlocker | fd342ee53c4f225ff1073c888b913727086133c3a77f9b65f99bdcf48aee2f22

General

Target

pr1_s4.malware.exe
Size

39KB
MD5

7529e3c83618f5e3a4cc6dbf3a8534a6
SHA1

0f944504eebfca5466b6113853b0d83e38cf885a
SHA256

ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
SHA512

7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

Score

10^/10

ragnarlocker bootkit persistence ransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_ED920661.txt

Ransom Note

Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************

Emails

[email protected]

Wallets

1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4

URLs

https://tox.chat/download.html

Signatures

RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

pr1_s4.malware.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\OutMove.crw => C:\Users\Admin\Pictures\OutMove.crw.ragnar_ED920661	pr1_s4.malware.exe
File renamed	C:\Users\Admin\Pictures\ResizeGroup.png => C:\Users\Admin\Pictures\ResizeGroup.png.ragnar_ED920661	pr1_s4.malware.exe
File renamed	C:\Users\Admin\Pictures\TraceDeny.crw => C:\Users\Admin\Pictures\TraceDeny.crw.ragnar_ED920661	pr1_s4.malware.exe
File renamed	C:\Users\Admin\Pictures\UnprotectResume.crw => C:\Users\Admin\Pictures\UnprotectResume.crw.ragnar_ED920661	pr1_s4.malware.exe
File renamed	C:\Users\Admin\Pictures\CompareUninstall.png => C:\Users\Admin\Pictures\CompareUninstall.png.ragnar_ED920661	pr1_s4.malware.exe
File renamed	C:\Users\Admin\Pictures\ExpandDeny.png => C:\Users\Admin\Pictures\ExpandDeny.png.ragnar_ED920661	pr1_s4.malware.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

pr1_s4.malware.exe

description ioc process

File opened (read-only) \??\E: pr1_s4.malware.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

pr1_s4.malware.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 pr1_s4.malware.exe

description	ioc	process
File opened (read-only)	\??\E:	pr1_s4.malware.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	pr1_s4.malware.exe

Drops file in Program Files directory 10154 IoCs

Processes:

pr1_s4.malware.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH.HXS	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar	pr1_s4.malware.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\RGNR_ED920661.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\blank.jtp	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10307_.GIF	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties	pr1_s4.malware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02263_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo	pr1_s4.malware.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\RGNR_ED920661.txt	pr1_s4.malware.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\RGNR_ED920661.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107290.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek	pr1_s4.malware.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\RGNR_ED920661.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg	pr1_s4.malware.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\RGNR_ED920661.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\ECHO.INF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183328.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00405_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_italic.gif	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\EUROTOOL.XLAM	pr1_s4.malware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif	pr1_s4.malware.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\RGNR_ED920661.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL054.XML	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg	pr1_s4.malware.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215070.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01361_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212957.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5	pr1_s4.malware.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\RGNR_ED920661.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00388_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02077_.GIF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099178.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198712.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00097_.WMF	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary	pr1_s4.malware.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\RGNR_ED920661.txt	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html	pr1_s4.malware.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar	pr1_s4.malware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif	pr1_s4.malware.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2008 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

1696 notepad.exe

pid	process
2008	vssadmin.exe

pid	process
1696	notepad.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1340	wmic.exe
Token: SeSecurityPrivilege	1340	wmic.exe
Token: SeTakeOwnershipPrivilege	1340	wmic.exe
Token: SeLoadDriverPrivilege	1340	wmic.exe
Token: SeSystemProfilePrivilege	1340	wmic.exe
Token: SeSystemtimePrivilege	1340	wmic.exe
Token: SeProfSingleProcessPrivilege	1340	wmic.exe
Token: SeIncBasePriorityPrivilege	1340	wmic.exe
Token: SeCreatePagefilePrivilege	1340	wmic.exe
Token: SeBackupPrivilege	1340	wmic.exe
Token: SeRestorePrivilege	1340	wmic.exe
Token: SeShutdownPrivilege	1340	wmic.exe
Token: SeDebugPrivilege	1340	wmic.exe
Token: SeSystemEnvironmentPrivilege	1340	wmic.exe
Token: SeRemoteShutdownPrivilege	1340	wmic.exe
Token: SeUndockPrivilege	1340	wmic.exe
Token: SeManageVolumePrivilege	1340	wmic.exe
Token: 33	1340	wmic.exe
Token: 34	1340	wmic.exe
Token: 35	1340	wmic.exe
Token: SeBackupPrivilege	840	vssvc.exe
Token: SeRestorePrivilege	840	vssvc.exe
Token: SeAuditPrivilege	840	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1340	wmic.exe
Token: SeSecurityPrivilege	1340	wmic.exe
Token: SeTakeOwnershipPrivilege	1340	wmic.exe
Token: SeLoadDriverPrivilege	1340	wmic.exe
Token: SeSystemProfilePrivilege	1340	wmic.exe
Token: SeSystemtimePrivilege	1340	wmic.exe
Token: SeProfSingleProcessPrivilege	1340	wmic.exe
Token: SeIncBasePriorityPrivilege	1340	wmic.exe
Token: SeCreatePagefilePrivilege	1340	wmic.exe
Token: SeBackupPrivilege	1340	wmic.exe
Token: SeRestorePrivilege	1340	wmic.exe
Token: SeShutdownPrivilege	1340	wmic.exe
Token: SeDebugPrivilege	1340	wmic.exe
Token: SeSystemEnvironmentPrivilege	1340	wmic.exe
Token: SeRemoteShutdownPrivilege	1340	wmic.exe
Token: SeUndockPrivilege	1340	wmic.exe
Token: SeManageVolumePrivilege	1340	wmic.exe
Token: 33	1340	wmic.exe
Token: 34	1340	wmic.exe
Token: 35	1340	wmic.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

pr1_s4.malware.exe

description	pid	process	target process
PID 1828 wrote to memory of 1340	1828	pr1_s4.malware.exe	wmic.exe
PID 1828 wrote to memory of 1340	1828	pr1_s4.malware.exe	wmic.exe
PID 1828 wrote to memory of 1340	1828	pr1_s4.malware.exe	wmic.exe
PID 1828 wrote to memory of 1340	1828	pr1_s4.malware.exe	wmic.exe
PID 1828 wrote to memory of 2008	1828	pr1_s4.malware.exe	vssadmin.exe
PID 1828 wrote to memory of 2008	1828	pr1_s4.malware.exe	vssadmin.exe
PID 1828 wrote to memory of 2008	1828	pr1_s4.malware.exe	vssadmin.exe
PID 1828 wrote to memory of 2008	1828	pr1_s4.malware.exe	vssadmin.exe
PID 1828 wrote to memory of 1696	1828	pr1_s4.malware.exe	notepad.exe
PID 1828 wrote to memory of 1696	1828	pr1_s4.malware.exe	notepad.exe
PID 1828 wrote to memory of 1696	1828	pr1_s4.malware.exe	notepad.exe
PID 1828 wrote to memory of 1696	1828	pr1_s4.malware.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\pr1_s4.malware.exe
"C:\Users\Admin\AppData\Local\Temp\pr1_s4.malware.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2008
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\RGNR_ED920661.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\RGNR_ED920661.txt

MD5
0880547340d1b849a7d4faaf04b6f905

SHA1
37fa5848977fd39df901be01c75b8f8320b46322

SHA256
84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25

SHA512
9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

Download Submit
memory/1340-2-0x0000000000000000-mapping.dmp

Download
memory/1696-4-0x0000000000000000-mapping.dmp

Download
memory/2008-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads