Sophos Ragnar May 2020

Ragnar Locker has used cmd.exe and batch scripts to execute commands.

Ragnar Locker may attempt to connect to removable drives and mapped network drives.

Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.

Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.

Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.

Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.

Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.

Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.

Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.

Ragnar Locker has used sc.exe to execute a service that it creates.

Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.