Ransom.Win32.RHYSIDA.YXDGTT

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers certain information on the affected computer.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %System%\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
• %System%\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
• %System%\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /end /tn Rhsd; schtasks /delete /tn Rhsd /f; schtasks /create /sc ONSTART /tn Rhsd /tr \"'{Malware File Path}\{Malware File Name}.exe' {accepted arguments}\" /ru system; schtasks /run /tn Rhsd /i
• %System%\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command \"Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f
• %System%\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "{Malware File Path}\{Malware File Name}.exe"
• %System%\cmd.exe /c cmd.exe /c reg delete \"HKCU\Contol Panel\Desktop\" /v Wallpaper /f
• %System%\cmd.exe /c cmd.exe /c reg delete \"HKCU\Conttol Panel\Desktop\" /v WallpaperStyle /f
• %System%\cmd.exe /c cmd.exe /c reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• %System%\cmd.exe /c cmd.exe /c reg add \"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• %System%\cmd.exe /c cmd.exe /c reg add \"HKCU\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d \"%Public%\bg.jpg\" /f
• %System%\cmd.exe /c cmd.exe /c reg add \"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\" /v Wallpaper /t REG_SZ /d \"%Public%\bg.jpg\" /f
• %System%\cmd.exe /c cmd.exe /c reg add \"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\" /v WallpaperStyle /t REG_SZ /d 2 /f
• %System%\cmd.exe /c cmd.exe /c reg add \"HKCU\Control Panel\Desktop\" /v WallpaperStyle /t REG_SZ /d 2 /f
• %System%\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Other System Modifications

This Ransomware changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

It sets the system's desktop wallpaper to the following image:

• %Public%\bg.jpg
  

Information Theft

This Ransomware gathers the following information on the affected computer:

• Number of processors
• System information

It accepts the following parameters:

• -d {path to encrypt} → used to specify directory to encrypt
• -sr → used to remove/delete itself if -S is not passed as an argument
• -nobg → avoids replacing desktop wallpaper and avoids disabling the ability to replace desktop wallpaper
• -md5
• -S → avoids ransomware routine and creates scheduled task named Rhsd to execute itself on system startup

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies
ActiveDesktop =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies
ActiveDesktop =

It does the following:

• It changes the desktop wallpaper after encryption and prevents the user from changing it back by modifying the NoChangingWallpaper registry value.
• It uses wevtutil.exe to clear Windows event logs.
• It initializes resources based on the number of processors available in the system.
• It encrypts all available drives from A to Z.

It adds the following scheduled tasks:

• Task Name: Rhsd
  Trigger: At system startup
  Action: Start a program: {Malware File Path}\{Malware File Name}.exe {accepted commands}

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• $Recycle.Bin
• Boot
• Documents and Settings
• PerfLogs
• ProgramData
• Recovery
• System Volume Information
• Windows
• $RECYCLE.BIN
• ApzData

It appends the following extension to the file name of the encrypted files:

• .rhysida

It drops the following file(s) as ransom note:

• {Encrypted Directory}\CriticalBreachDetected.pdf
  

It avoids encrypting files with the following file extensions:

• .bat
• .bin
• .cab
• .cmd
• .com
• .cur
• .diagcab
• .diagcfg
• .diagpkg
• .drv
• .dll
• .exe
• .hlp
• .hta
• .ico
• .msi
• .ocx
• .ps1
• .psm1
• .scr
• .sys
• .ini
• .Thumbs.db
• .url
• .iso