Ransom.Win32.CONTI.FAJF

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Précisions sur l'apparition de l'infection

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Introduit les fichiers suivants :

• {Log File Path}\{Log Filename} → If -log argument is used

Ajoute les processus suivants :

• cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{Shadowcopy ID}'" delete → repeated depending on the number of shadow copies

Ajoute les algorithmes Mutex suivants afin d''éviter que plusieurs de ses duplicats ne s''exécutent simultanément :

• YUIOGHJKCVVBNMFGHJKTYQUWIETASKDHGZBDGSKL237782321344

Autres précisions

Il fait ce qui suit:

• It uses the Windows Restart Manager to unlock files it will encrypt.
• When encrypting network shares it will check if the IP address starts with the following to ensure that it is encrypting local, non-Internet, systems:
  • 172.
  • 192.168.
  • 10.
  • 169.
• It accepts the following parameters:
  • -m {all|local|net|backups}
  • all - combination of net and local
  • local - delete backups and encrypt only locally found drives
  • net - delete backups and encrypt only network shares
  • backups - delete backups
  • -p {Directory} - Will encrypt first the folders in the list before proceeding to the others
  • -log {Log File Path}\{Log Filename} - Log output to {Log File Path}\{Log Filename}
  • -nomutex - Creates no mutex allowing multiple process
  • -size {chunk mode}
• By default, it encrypts local drives, removable drives and network shares