Ransom.Win64.ABYSSLOCKER.YPEDR

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {malware directory}/work.log
• %User Temp%\readme.bmp → desktop wallpaper ransom

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Agrega los procesos siguientes:

• vssadmin.exe delete shadows /all /quiet
• wmic SHADOWCOPY DELETE
• bcdedit / set{ default } recoveryenabled No
• bcdedit / set{ default } bootstatuspolicy ignoreallfailures

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• DontWorryBeHappy

Otras modificaciones del sistema

Cambia el fondo de escritorio mediante la modificación de las siguientes entradas de registro:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\readme.bmp

Finalización del proceso

Finaliza los servicios siguientes si los detecta en el sistema afectado:

• MSSQLServerADHelper100
• MSSQL$ISARS
• MSSQL$MSFW
• SQLAgent$ISARS
• SQLAgent$MSFW
• SQLBrowser
• ReportServer$ISARS
• SQLWriter
• WinDefend
• mr2kserv
• MSExchangeADTopology
• MSExchangeFBA
• MSExchangeIS
• MSExchangeSA
• ShadowProtectSvc
• SPAdminV4
• SPTimerV4
• SPTraceV4
• SPUserCodeV4
• SPWriterV4
• SPSearch4
• IISADMIN
• firebirdguardiandefaultinstance
• ibmiasrw
• QBCFMonitorService
• QBVSS
• QBPOSDBServiceV12
• IBM Domino Server (CProgramFilesIBMDominodata)
• IBM Domino Diagnostics (CProgramFilesIBMDomino)
• Simply Accounting Database Connection Manager
• QuickBooksDB1
• QuickBooksDB2
• QuickBooksDB3
• QuickBooksDB4
• QuickBooksDB5wrapper
• DefWatch
• ccEvtMgr
• ccSetMgr
• SavRoamSqlservr
• sqlagent
• sqladhlp
• Culserver
• RTVscansqlbrowser
• SQLADHLP
• QBIDPService
• IntuitQuickBooksFCS
• msmdsrv
• tomcat6
• zhudongfangyu
• vmware - usbarbitator64
• vmware - converter
• dbsrv12
• dbeng8
• MSSQL$MICROSOFT##WID
• MSSQL$VEEAMSQL2012
• SQLAgent$VEEAMSQL2012
• FishbowlMySQ
• MySQL57MSSQL$KAV_CS_ADMIN_KIT
• SQLAgent$KAV_CS_ADMIN_KIT
• msftesql - Exchange
• MSSQL$MICROSOFT##SSEE
• MSSQL$SBSMONITORING
• MSSQL$SHAREPOINT
• MSSQLFDLauncher$SBSMONITORING
• MSSQLFDLauncher$SHAREPOINT
• SQLAgent$SBSMONITORING
• SQLAgent$SHAREPOINT
• QBFCService
• YooBackup
• YooIT
• vsssqlsvc$
• MSSQL
• MSSQL$
• memtas
• mepocs
• sophos
• veeam
• backup
• bedbg
• PDVFSService
• BackupExecVSSProvider
• BackupExecAgentAccelerator
• BackupExecAgentBrowser
• BackupExecDiveciMediaService
• BackupExecJobEngine
• BackupExecManagementService
• BackupExecRPCService
• MVArmorMVarmor64
• stc_raw_agent
• VSNAPVSS
• VeeamTransportSvc
• VeeamDeploymentService
• VeeamNFSSvc
• AcronisAgent
• ARSM
• AcrSch2Svc
• CASAD2DWebSvc
• CAARCUpdateSvc
• WSBExchange
• MSExchange
• MSExchange$GxVss
• GxBlr
• GxFWD
• GxCVD
• GxCIMgr

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• 360doctor.exe
• 360se.exe
• ADExplorer.exe
• ADExplorer64.exe
• ADExplorer64a.exe
• Adobe CEF.exe
• Adobe Desktop Service.exe
• AdobeCollabSync.exe
• AdobeIPCBroker.exe
• AutodeskDesktopApp.exe
• Autoruns.exe
• Autoruns64.exe
• Autoruns64a.exe
• Autorunsc.exe
• Autorunsc64.exe
• Autorunsc64a.exe
• AvastUI.exe
• BrCcUxSys.exe
• BrCtrlCntr.exe
• CNTAoSMgr.exe
• CagService.exe
• CoreSync.exe
• Creative Cloud.exe
• Culture.exe
• Defwatch.exe
• DellSystemDetect.exe
• EnterpriseClient.exe
• GDscan.exe
• GWCtlSrv.exe
• GlassWire.exe
• Helper.exe
• InputPersonalization.exe
• MsDtSrvr.exe
• MsDtsSrvr.exe
• MsMpEng.exe
• ONENOTEM.exe
• PccNTMon.exe
• ProcessHacker.exe
• Procexp.exe
• Procexp64.exe
• QBDBMgr.exe
• QBDBMgrN.exe
• QBIDPService.exe
• QBW32.exe
• RAgui.exe
• RTVscan.exe
• Raccine.exe
• RaccineElevatedCfg.exe
• RaccineSettings.exe
• Raccine_x86.exe
• RdrCEF.exe
• ReportingServicesService.exe
• SQLAGENT.EXE
• Simply.SystemTrayIcon.exe
• SimplyConnectionManager.exe
• Sqlservr.exe
• Ssms.exe
• Sysmon.exe
• Sysmon64.exe
• SystemExplorer.exe
• SystemExplorerService.exe
• SystemExplorerService64.exe
• TMBMSRV.exe
• TeamViewer.exe
• TeamViewer_Service.exe
• TitanV, Ssms.exe
• TmCCSF.exe
• TmListen.exe
• TmPfw.exe
• TmProxy.exe
• Totalcmd.exe
• Totalcmd64.exe
• VeeamDeploymentSvc.exe
• WRSA.exe
• WireShark.exe
• ZhuDongFangYu.exe
• acwebbrowser.exe
• agntsvc.exe
• avp.exe
• avz.exe
• axlbridge.exe
• bedbh.exe
• benetns.exe
• bengien.exe
• beserver.exe
• dbeng50.exe
• dbsnmp.exe
• dumpcap.exe
• egui.exe
• encsvc.exe
• excel.exe
• fbguard.exe
• fbserver.exe
• fdhost.exe
• fdlauncher.exe
• firefox.exe
• httpd.exe
• infopath.exe
• isqlplussvc.exe
• j0gnjko1.exe
• java.exe
• msaccess.exe
• msftesql.exe
• msmdsrv.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld.exe
• node.exe
• notepad++.exe
• notepad.exe
• ntrtscan.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• onenote.exe
• oracle.exe
• outlook.exe
• pg_ctl.exe
• postgres.exe
• powerpnt.exe
• procexp64a.exe
• procmon.exe
• procmon64.exe
• procmon64a.exe
• pvlsvr.exe
• qbupdate.exe
• raw_agent_svc.exe
• sam.exe
• sqbcoreservice.exe
• sql.exe
• sqlbrowser.exe
• sqlceip.exe
• sqlmangr.exe
• sqlservr.exe
• sqlwriter.exe
• steam.exe
• supervise.exe
• synctime.exe
• tbirdconfig.exe
• tcpview.exe
• tcpview64.exe
• tcpview64a.exe
• tdsskiller.exe
• thebat.exe
• thunderbird.exe
• tomcat6.exe
• tv_w32.exe
• tv_x64.exe
• visio.exe
• vsnapvss.exe
• vxmon.exe
• wdswfsafe.exe
• winword.exe
• wordpad.exe
• wsa_service.exe
• wxServer.exe
• wxServerView.exe
• xfssvccon.exe

Otros detalles

Hace lo siguiente:

• It empties the recycle bin of the affected system.
• Avoids encrypting the following network shares:
  • ADMIN$
  • IPC$