ragnarlocker | ce33096639fb5c51684e9e3a7c7c7161884ecad29e8d6ad602fd8be42076b8d4

General

Target

CaronaTracker.exe
Size

798KB
MD5

cd4bf534b1596b2d456bd269e6881aa0
SHA1

09d5f2142158ee0919c1c9e2dc6fbcc3bbef452c
SHA256

ce33096639fb5c51684e9e3a7c7c7161884ecad29e8d6ad602fd8be42076b8d4
SHA512

3cd9f3156926fea5bad5dda2e3897506eb20dc4b95ec706193bb1f4d17a4549a62c10db7eb2e666cffd906d0f72dbf50f835631246a9bd495472fcf5a0240c14

Score

10^/10

ragnarlocker bootkit persistence ransomware

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_ED920661.txt

Ransom Note

Hello PSE_CREDIT_UNION ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU Amount to pay (in Bitcoin): 60 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- MmE2RjY2N2YwNUZlYmRERjNhZGY4MWY0Y0NiMUEwNEIwRkYyQUZhNDE5QjEwNzYzODhGZjE2QWM5ZGFEYzEwYg== ---RAGNAR SECRET--- ***********************************************************************************

Emails

[email protected]

Wallets

1E6EjTqYPHLj1uovPKKRXzMpPCcpAcVuiU

URLs

https://tox.chat/download.html

Signatures

RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

CaronaTracker.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExpandRedo.crw => C:\Users\Admin\Pictures\ExpandRedo.crw.ragnar_ED920661	CaronaTracker.exe
File renamed	C:\Users\Admin\Pictures\MoveRedo.tif => C:\Users\Admin\Pictures\MoveRedo.tif.ragnar_ED920661	CaronaTracker.exe
File renamed	C:\Users\Admin\Pictures\ReadGrant.tif => C:\Users\Admin\Pictures\ReadGrant.tif.ragnar_ED920661	CaronaTracker.exe
File renamed	C:\Users\Admin\Pictures\TestSelect.tif => C:\Users\Admin\Pictures\TestSelect.tif.ragnar_ED920661	CaronaTracker.exe
File renamed	C:\Users\Admin\Pictures\WaitMount.png => C:\Users\Admin\Pictures\WaitMount.png.ragnar_ED920661	CaronaTracker.exe
File renamed	C:\Users\Admin\Pictures\CloseSplit.crw => C:\Users\Admin\Pictures\CloseSplit.crw.ragnar_ED920661	CaronaTracker.exe
File renamed	C:\Users\Admin\Pictures\DebugEdit.tif => C:\Users\Admin\Pictures\DebugEdit.tif.ragnar_ED920661	CaronaTracker.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

CaronaTracker.exe

description ioc process

File opened (read-only) \??\E: CaronaTracker.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

CaronaTracker.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 CaronaTracker.exe

description	ioc	process
File opened (read-only)	\??\E:	CaronaTracker.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	CaronaTracker.exe

Drops file in Program Files directory 64 IoCs

Processes:

CaronaTracker.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll	CaronaTracker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_ON.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Recife	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313965.JPG	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK	CaronaTracker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer	CaronaTracker.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\RGNR_ED920661.txt	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB02229_.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00525_.WMF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR13F.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	CaronaTracker.exe
File created	C:\Program Files (x86)\Windows NT\RGNR_ED920661.txt	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml	CaronaTracker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Urban.eftx	CaronaTracker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_ON.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABON.JPG	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\logo.png	CaronaTracker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka	CaronaTracker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png	CaronaTracker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.XML	CaronaTracker.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\RGNR_ED920661.txt	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02736U.BMP	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.JPG	CaronaTracker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	CaronaTracker.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\RGNR_ED920661.txt	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar	CaronaTracker.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RGNR_ED920661.txt	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01747_.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Couture.thmx	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left_over.gif	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar	CaronaTracker.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\RGNR_ED920661.txt	CaronaTracker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png	CaronaTracker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF	CaronaTracker.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\RGNR_ED920661.txt	CaronaTracker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2B.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\PREVIEW.GIF	CaronaTracker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP	CaronaTracker.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1944 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

108 notepad.exe

pid	process
1944	vssadmin.exe

pid	process
108	notepad.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

wmic.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1300	wmic.exe
Token: SeSecurityPrivilege	1300	wmic.exe
Token: SeTakeOwnershipPrivilege	1300	wmic.exe
Token: SeLoadDriverPrivilege	1300	wmic.exe
Token: SeSystemProfilePrivilege	1300	wmic.exe
Token: SeSystemtimePrivilege	1300	wmic.exe
Token: SeProfSingleProcessPrivilege	1300	wmic.exe
Token: SeIncBasePriorityPrivilege	1300	wmic.exe
Token: SeCreatePagefilePrivilege	1300	wmic.exe
Token: SeBackupPrivilege	1300	wmic.exe
Token: SeRestorePrivilege	1300	wmic.exe
Token: SeShutdownPrivilege	1300	wmic.exe
Token: SeDebugPrivilege	1300	wmic.exe
Token: SeSystemEnvironmentPrivilege	1300	wmic.exe
Token: SeRemoteShutdownPrivilege	1300	wmic.exe
Token: SeUndockPrivilege	1300	wmic.exe
Token: SeManageVolumePrivilege	1300	wmic.exe
Token: 33	1300	wmic.exe
Token: 34	1300	wmic.exe
Token: 35	1300	wmic.exe
Token: SeBackupPrivilege	1800	vssvc.exe
Token: SeRestorePrivilege	1800	vssvc.exe
Token: SeAuditPrivilege	1800	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1300	wmic.exe
Token: SeSecurityPrivilege	1300	wmic.exe
Token: SeTakeOwnershipPrivilege	1300	wmic.exe
Token: SeLoadDriverPrivilege	1300	wmic.exe
Token: SeSystemProfilePrivilege	1300	wmic.exe
Token: SeSystemtimePrivilege	1300	wmic.exe
Token: SeProfSingleProcessPrivilege	1300	wmic.exe
Token: SeIncBasePriorityPrivilege	1300	wmic.exe
Token: SeCreatePagefilePrivilege	1300	wmic.exe
Token: SeBackupPrivilege	1300	wmic.exe
Token: SeRestorePrivilege	1300	wmic.exe
Token: SeShutdownPrivilege	1300	wmic.exe
Token: SeDebugPrivilege	1300	wmic.exe
Token: SeSystemEnvironmentPrivilege	1300	wmic.exe
Token: SeRemoteShutdownPrivilege	1300	wmic.exe
Token: SeUndockPrivilege	1300	wmic.exe
Token: SeManageVolumePrivilege	1300	wmic.exe
Token: 33	1300	wmic.exe
Token: 34	1300	wmic.exe
Token: 35	1300	wmic.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

CaronaTracker.exe

description	pid	process	target process
PID 1856 wrote to memory of 1300	1856	CaronaTracker.exe	wmic.exe
PID 1856 wrote to memory of 1300	1856	CaronaTracker.exe	wmic.exe
PID 1856 wrote to memory of 1300	1856	CaronaTracker.exe	wmic.exe
PID 1856 wrote to memory of 1300	1856	CaronaTracker.exe	wmic.exe
PID 1856 wrote to memory of 1944	1856	CaronaTracker.exe	vssadmin.exe
PID 1856 wrote to memory of 1944	1856	CaronaTracker.exe	vssadmin.exe
PID 1856 wrote to memory of 1944	1856	CaronaTracker.exe	vssadmin.exe
PID 1856 wrote to memory of 1944	1856	CaronaTracker.exe	vssadmin.exe
PID 1856 wrote to memory of 108	1856	CaronaTracker.exe	notepad.exe
PID 1856 wrote to memory of 108	1856	CaronaTracker.exe	notepad.exe
PID 1856 wrote to memory of 108	1856	CaronaTracker.exe	notepad.exe
PID 1856 wrote to memory of 108	1856	CaronaTracker.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\CaronaTracker.exe
"C:\Users\Admin\AppData\Local\Temp\CaronaTracker.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1944
- C:\Windows\SysWOW64\notepad.exe
  C:\Users\Public\Documents\RGNR_ED920661.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:108

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\RGNR_ED920661.txt

MD5
a542fcfee82ad3375a5adf7df8997d88

SHA1
b6a001fae92f9e8f4d580438b7170fd29d4f0722

SHA256
11d42766b1cb0b76e7d3d040ddd90ea8243992145d831852b277e3b0d670f1e0

SHA512
89a81e4ea3746d4c880fe7a50f00b259c66938eb776a43c9f6518bdb3f3f3f4808a120451e09e3bbe82b5175924d17aaf36a9b60f4530888d1d1fb985ffd76e0

Download Submit
memory/108-6-0x0000000000000000-mapping.dmp

Download
memory/620-5-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

Filesize
8KB

Download
memory/1300-3-0x0000000000000000-mapping.dmp

Download
memory/1856-2-0x00000000767E1000-0x00000000767E3000-memory.dmp

Filesize
8KB

Download
memory/1944-4-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads