Ransom.MSIL.THANOS.SM

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\{random characters}.exe
• %User Startup%\reload1.lnk

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

It adds the following processes:

• "taskkill" /F /IM RaccineSettings.exe
• "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
• "reg" delete HKCU\Software\Raccine /F
• "schtasks" /DELETE /TN "Raccine Rules Updater" /F
• "sc.exe" config Dnscache start= auto
• "sc.exe" config SQLTELEMETRY start= disabled
• "sc.exe" config FDResPub start= auto
• "sc.exe" config SSDPSRV start= auto
• "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
• "sc.exe" config SstpSvc start= disabled
• "sc.exe" config upnphost start= auto
• "sc.exe" config SQLWriter start= disabled
• "taskkill.exe" /IM mspub.exe /F
• "taskkill.exe" /IM synctime.exe /F
• "taskkill.exe" /IM mspub.exe /F
• "taskkill.exe" /IM mydesktopqos.exe /F
• "taskkill.exe" /IM mysqld.exe /F
• "taskkill.exe" /IM Ntrtscan.exe /F
• "taskkill.exe" /IM mydesktopservice.exe /F
• "taskkill.exe" /IM sqbcoreservice.exe /F
• "taskkill.exe" /IM firefoxconfig.exe /F
• "taskkill.exe" /IM isqlplussvc.exe /F
• "taskkill.exe" /IM encsvc.exe /F
• "taskkill.exe" /IM agntsvc.exe /F
• "taskkill.exe" /IM onenote.exe /F
• "taskkill.exe" /IM tbirdconfig.exe /F
• "taskkill.exe" /IM excel.exe /F
• "taskkill.exe" /IM thebat.exe /F
• "taskkill.exe" /IM CNTAoSMgr.exe /F
• "taskkill.exe" /IM PccNTMon.exe /F
• "taskkill.exe" /IM dbeng50.exe /F
• "taskkill.exe" /IM msaccess.exe /F
• "taskkill.exe" /IM steam.exe /F
• "taskkill.exe" /IM sqlwriter.exe /F
• "taskkill.exe" /IM thebat64.exe /F
• "taskkill.exe" /IM outlook.exe /F
• "taskkill.exe" /IM ocomm.exe /F
• "taskkill.exe" /IM tmlisten.exe /F
• "taskkill.exe" /IM wordpad.exe /F
• "taskkill.exe" /IM oracle.exe /F
• "taskkill.exe" /IM msftesql.exe /F
• "taskkill.exe" /IM infopath.exe /F
• "taskkill.exe" /IM mysqld-opt.exe /F
• "taskkill.exe" /IM powerpnt.exe /F
• "taskkill.exe" /IM sqlagent.exe /F
• "taskkill.exe" /IM mbamtray.exe /F
• "taskkill.exe" /IM sqlbrowser.exe /F
• "taskkill.exe" /IM ocautoupds.exe /F
• "taskkill.exe" /IM mydesktopqos.exe /F
• "taskkill.exe" /IM zoolz.exe /F
• "taskkill.exe" /IM sqlservr.exe /F
• "taskkill.exe" /IM ocssd.exe /F
• "taskkill.exe" IM thunderbird.exe /F
• "taskkill.exe" /IM visio.exe /F
• "taskkill.exe" /IM dbsnmp.exe /F
• "taskkill.exe" /IM mydesktopservice.exe /F
• "taskkill.exe" /IM xfssvccon.exe /F
• "taskkill.exe" /IM winword.exe /F
• "taskkill.exe" /IM mysqld-nt.exe /F
• "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete() }
• "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
• "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
• "arp" -a
• "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
• ping 127.0.0.7 -n 3
• "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
• "%System%\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "{Malware path and name}
• "%System%\notepad.exe" %Desktop%\RESTORE_FILES_INFO.txt
• "%User Temp%\{random characters}.exe" \{local IP address} -d -h -s -f -accepteula -nobanner -c "{Malware path and name}"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\KEYID\
myKeyID
ID1 = {string}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
LegalNoticeCaption = YOUR COMPANY IS HACKED AND COMPROMISED

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
legalnoticecaption = YOUR COMPANY IS HACKED AND COMPROMISED

HKEY_CURRENT_USER\Software\Sysinternals\
PsExec
EulaAccepted = 1

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\KEYID

HKEY_CURRENT_USER\Software\Sysinternals\
PsExec

HKEY_CURRENT_USER\Software\KEYID\
myKeyID

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .KOUMU

It drops the following file(s) as ransom note:

• %User Temp%\RESTORE_FILES_INFO.txt
• %Desktop%\RESTORE_FILES_INFO.txt
• {Encrypted Directory}\RESTORE_FILES_INFO.txt

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)