Ransom.Win32.TARGETCOMP.YXCKCZ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• "%System%\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /c bcdedit /set {current} recoveryenabled no
• "%Windows%\sysnative\vssadmin.exe" delete shadows /all /quiet
• taskill -f -im {Stopped Processes}
• sc delete {Deleted Services}

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)

Andere Systemänderungen

Ändert die folgenden Registrierungseinträge:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideShutDown
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideRestart
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideSignOut
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
shutdownwithoutlogon = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0

Löscht die folgenden Registrierungsschlüssel:

HKEY_CURRENT_USER\SOFTWARE\Raccine

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\EventLog\Application\
Raccine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vssadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wmic.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wbadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bcdedit.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
powershell.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
diskshadow.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
net.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskkill.exe

Prozessbeendigung

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• sqlserv.exe
• oracle.exe
• ntdbsmgr.exe
• sqlservr.exe
• sqlwriter.exe
• MsDtsSrvr.exe
• msmdsrv.exe
• ReportingServecesService.exe
• fdhost.exe
• fdlauncher.exe
• mysql.exe


• where (Stopped Processes}
• sqlwriter.exe
• sqlservr.exe
• msmdsrv.exe
• MsDtsSrvr.exe
• sqlceip.exe
• fdlauncher.exe
• Ssms.exe
• SQLAGENT.EXE
• fdhost.exe
• fdlauncher.exe
• sqlservr.exe
• ReportingServicesService.exe
• msftesql.exe
• pg_ctl.exe
• postgres.exe

Datendiebstahl

Folgende Daten werden gesammelt:

• Computer Name
• Product Name
• OS Architecture
• Application Privilege

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• http://{BLOCKED}.{BLOCKED}.191.141/QWEwqdsvsf/ap.php

Andere Details

Es macht Folgendes:

• It encrypts files from local drives, removable drives, and network shares.
• It DOES NOT continue to routine if User Default Language ID of the system is any of the following:
• Russian (0x419)
• Kazakh (0x43F)
• Belarusian (0x423)
• Ukrainian (0x422)
• Tatar (0x444)
• It blocks any system shutdown and displays the following the message:
  • "Do NOT shutdown OR reboot your PC: this might damage your files permanently !"
• It reverts the following modified registries entries back to its default values after encryption:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Policies\System\shutdownwithoutlogon
• It deletes the following services {Deleted Services}:
  • MSSQLFDLauncher
  • MSSQLSERVER
  • SQLSERVERAGENT
  • SQLBrowser
  • SQLTELEMETRY
  • MsDtsServer130
  • SSISTELEMETRY130
  • SQLWriter
  • MSSQL$VEEAMSQL2012
  • SQLAgent$VEEAMSQL2012
  • MSSQL
  • SQLAgent
  • MSSQLServerADHelper100
  • MSSQLServerOLAPService
  • MsDtsServer100
  • ReportServer
  • SQLTELEMETRY$HL
  • TMBMServer
  • MSSQL$PROGID
  • MSSQL$WOLTERSKLUWER
  • SQLAgent$PROGID
  • SQLAgent$WOLTERSKLUWER
  • MSSQLFDLauncher$OPTIMA
  • MSSQL$OPTIMA
  • SQLAgent$OPTIMA
  • ReportServer$OPTIMA
  • msftesql$SQLEXPRESS
  • postgresql-x64-9.4