Ransom.Win32.GRIEF.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• vssadmin.exe Delete Shadows /All /Quiet
• bcdedit.exe /set {default} safeboot minimal
• bcdedit.exe /set {default} recoveryenabled No
• %System%\icacls.exe ":\*" /grant:r Everyone:F /t /c /q -> grant access to the drives it encrypts

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeCaption = We made you. P0G-{number}

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeText =

Process Termination

This Ransomware terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• sqlagent
• sophos

Other Details

This Ransomware does the following:

• It expects itself to be executed as a service
• It installs itself as a service through modifying a service's ImagePath to point to itself and execute it along with its correct argument
• In these particular samples, there is currently no way to terminate processes. The embedded Process Hacker is not included in the ransomware samples, and it does not enumerate running processes
• It removes connections to network shared resources
• It requires a specific argument in order for it to proceed to its malicious routine
• It changes the password of every user to the following:
  • JaR99"Zd!51E4ECAE7509C3130AC4D2AD949E171F
• It initiates a system reboot after its installation

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• svsho*.exe
• schre*.bat
• V01.lo*
• V01.ch*
• V01res*.jrs
• RacWmi*.sdf
• Web*V01.dat
• default.rdp
• NTUSER.DA*
• *.lnk
• *.ico
• *.ini
• *.msi
• *.chm
• *.sys
• *.hlf
• *.lng
• *.inf
• *.ttf
• *.cmd
• *.LNK
• *.ICO
• *.INI
• *.MSI
• *.CHM
• *.SYS
• *.HLF
• *.LNG
• *.INF
• *.TTF
• *.CMD

It avoids encrypting files found in the following folders:

• $RECYCLE.BIN
• $Recycle.Bin
• Caches
• WebCache
• VirtualStore

It appends the following extension to the file name of the encrypted files:

• .payorgrief

It drops the following file(s) as ransom note:

• {encrypted file name}.helpme.html - drops it for every file it encrypts