Ransom.Win32.MIMIC.A

Publish Date: 23 de lutego de 2023

Author: Kim Benedict Victorio

UDS:Trojan-Ransom.Win32.Mimic.q (KASPERSKY)

PLATFORM:

Windows

OVER ALL RISK RATING:

DAMAGE POTENTIAL::

DISTRIBUTION POTENTIAL::

REPORTED INFECTION:

INFORMATION EXPOSURE:

Low

Medium

High

Critical

Threat Type:
Ransomware
Destructiveness:
No
Encrypted:
Yes
In the wild::
Yes

OVERVIEW

INFECTION CHANNEL: Descargado de Internet, Eliminado por otro tipo de malware

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina entradas de registro para causar el funcionamiento incorrecto de aplicaciones y programas.

TECHNICAL DETAILS

File size: 2,909,429 bytes

File type: EXE

Memory resident: Yes

INITIAL SAMPLES RECEIVED DATE: 17 de lutego de 2023

PAYLOAD: Terminates processes, Drops files, Deletes files

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

%User Temp%\7ZipSfx.000\7za.exe
%User Temp%\7ZipSfx.000\Everything.exe
%User Temp%\7ZipSfx.000\Everything32.dll
%User Temp%\7ZipSfx.000\Everything64.dll
%User Temp%\7ZipSfx.000\Everything.ini
%User Temp%\7ZipSfx.000\Everything2.ini
%User Temp%\7ZipSfx.000\Horsesperm.exe
%User Temp%\7ZipSfx.000\sdel.exe
%User Temp%\7ZipSfx.000\sdel64.exe
%User Temp%\7ZipSfx.000\session.tmp
%User Temp%\7ZipSfx.000\Defender.exe
%AppDataLocal%\{GUID}\7za.exe → Copy file
%AppDataLocal%\{GUID}\Everything.exe → Copy file
%AppDataLocal%\{GUID}\Everything32.dll → Copy file
%AppDataLocal%\{GUID}\Everything64.dll → Copy file
%AppDataLocal%\{GUID}\Everything.ini → Copy file
%AppDataLocal%\{GUID}\Everything2.ini → Copy file
%AppDataLocal%\{GUID}\Horsesperm.exe → Copy file
%AppDataLocal%\{GUID}\sdel.exe → Copy file
%AppDataLocal%\{GUID}\sdel64.exe → Copy file
%AppDataLocal%\{GUID}\session.tmp → Copy file
%AppDataLocal%\{GUID}\Defender.exe → Copy file
{All affected directories}\Bigspermhorseballs_Decryption.txt
%UserTemp%\session.tmp
%UserTemp%\{Random Letters}.{Random Letters}.ps1 → It Deletes after
%UserTemp%\{Random Letters}.{Random Letters}.psm1 → It Deletes after

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

)

Agrega los procesos siguientes:

"%UserTemp%\7ZipSfx.000\7za.exe" x -y -p23980242011156913804 Everything64.dll
"%UserTemp%\7ZipSfx.000\7za.exe" i
cmd.exe /c DC.exe /D
"%AppDataLocal%\{GUID}Defender.exe"
"%AppDataLocal%\{GUID}Defender.exe" -e watch -pid {PID of Defender.exe} -!
"%AppDataLocal%\{GUID}Defender.exe" -e ul1
"%AppDataLocal%\{GUID}Defender.exe" -e ul2
"%Program Files%\Everything\Everything.exe" -startup
powercfg.exe -H off
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 1} {GUID Group} {GUID Setting 1} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 1} {GUID Group} {GUID Setting 2} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 1} {GUID Group} {GUID Setting 3} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 1} {GUID Group} {GUID Setting 1} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 1} {GUID Group} {GUID Setting 2} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 1} {GUID Group} {GUID Setting 3} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Group} {GUID Setting 1} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Group} {GUID Setting 2} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Group} {GUID Setting 3} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Group} {GUID Setting 1} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Group} {GUID Setting 2} 0"
"powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Group} {GUID Setting 3} 0"
"powercfg.exe -S {Power scheme GUID 1}"
"powercfg.exe -S {Power scheme GUID 2}"
"powershell.exe -ExecutionPolicy Bypass ""Get-VM | Stop-VM"""
"powershell.exe -ExecutionPolicy Bypass ""Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"""
"powershell.exe -ExecutionPolicy Bypass ""Get-Volume | Get-DiskImage | Dismount-DiskImage"""

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

)

Crea las carpetas siguientes:

%AppDataLocal%\{GUID}
%System Root%\temp

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

)

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

oooiheWoeohohLeooho

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Defender = %AppDataLocal%\{GUID}\Defender.exe

Otras modificaciones del sistema

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\VSS
Start = 4