Ransom.Win32.RAGNAROK.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %System%\cmd.exe /c vssadmin delete shadows /all /quiet → Clear Shadow Volume Copies
• %System%\cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
• %System%\cmd.exe /c bcdedit /set {current} recoveryenabled no
• %System%\cmd.exe /c netsh advfirewall set allprofiles state off → Turn off Windows Firewall

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• name

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableRealtimeMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = 1

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• Process Names containing the following strings:
  • sql
  • note
  • powerpnt
  • winword
  • excel

Other Details

This Ransomware does the following:

• Checks the installed Windows Language ID, if equal to the following and if it matches it will not perform its encryption:
  • 040a = Spanish - Spain (Traditional)
  • 040d = Hebrew
  • 0419 = Russian
  • 0422 = Ukrainian
  • 0423 = Belarusian
  • 0428 = Tajik
  • 042b = Armenian
  • 042c = Azeri - Latin
  • 043f = Kazakh
  • 0440 = Kyrgyz - Cyrillic
  • 0442 = Turkmen
  • 0443 = Uzbek - Latin
  • 0451 = Tibetan
  • 0478 = Yi
  • 0480 = Uighur - China
  • 0804 = Chinese - China
  • 0819 = Russian - Moldova
  • 082c = Azeri - Cyrillic

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• content.ie5
• \temporary internet files
• \local settings\temp
• \appdata\local\temp
• \program files
• \windows
• \programdata
• $

It appends the following extension to the file name of the encrypted files:

• .ragnarok

It drops the following file(s) as ransom note:

• {Encrypted Folder}\How_To_Decrypt_My_Files.txt
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .sys
• .ragnarok