Ransom.Win32.LIVEDE.THLBHBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {malware directory}\libgobject-2.0-0.dll
• {malware directory}\libiconv-2.dll
• {malware directory}\libintl-8.dll
• {malware directory}\libpcre2-8-0.dll
• {malware directory}\livelocked.exe
• {malware directory}\windows_encryptor_180870197840.exe
• {malware directory}\libffi-8.dll
• {malware directory}\libglib-2.0-0.dll

It adds the following processes:

• bcdedit /set {current} recoveryenabled no
• bcdedit /set {default} recoveryenabled no
• bcdedit /set {current} bootstatuspolicy ignoreallfailures
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• vssadmin Delete Shadows /All /Quiet
• wbadmin DELETE BACKUP -keepVersions:0 -quiet
• taskkill /F /IM {process name}
• net stop {service name} /y
• wevtutil cl application
• wevtutil cl security
• wevtutil cl system

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

Other Details

This Ransomware does the following:

• The file is a self-extracting archive.
• Clears event logs to hide its malicious behaviors.
• It encrypts drives from A:\ to Z:\

It accepts the following parameters:

• -s, --self
• -h, --help, -help, /?
• -d, --directory
• -dr, --deleteRestorePoints {true, false}
• -ss, --stopServices {true, false}
• -sp, --stopProcesses {true, false}
• -dn, --dropNote {true, false}
• -cw, --changeWallpaper {false}

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• C:\Program Files
• C:\Program Files(x86)
• C:\ProgramData
• C:\Windows
• C:\msys64
• C:\Users\All Users

It appends the following extension to the file name of the encrypted files:

• {original filename}.{original extension}.live

It drops the following file(s) as ransom note:

• {encrypted directory}\FILE RECOVERY_ID_393FB90.txt
  

It avoids encrypting files with the following file extensions:

• exe
• dll
• ini
• tmp
• url
• lnk
• ps1
• nls
• shs
• themepack
• bin
• msp
• wpx
• bat
• sys
• spl
• scr
• icl
• rom
• msc
• ico
• LIVE