Ransom.Win32.DOPPELPAYMER.TGACAP

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware se elimina tras la ejecución.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Application Data%\{Random Name} - dropped copy of itself
• When run with administrator privileges:
  • %Application Data%\{Random}\{Dll Name from %System% directory}.dll - used to hijack processhacker via DLL side-loading and communicate with main malware process to terminate processes/services
  • %Application Data%\{Random}\{Random Name 1} - detected as PUA.Win32.ProcHack.C
  • %Application Data%\{Random}\{Random Name 2} - detected as PUA.Win32.ProcHack.B.component
  • %System%\GroupPolicy\gpt.ini
• When ran without administrator privileges:
  • %Application Data%\{Random Name}\{Random Name}.exe - dropped copy of itself

Agrega los procesos siguientes:

• %Application Data%\{Random Name} {argument to execute} {Malware Filename}
• When ran with administrative privileges:
  • %System%\bcedit.exe /set {default} safeboot minimal
  • %System%\bcedit.exe /set default recoveryenabled no
  • %System%\vssadmin.exe Delete Shadows /All /Quiet - delete shadow copy
  • %Application Data%\{Random}\{Random Name 2} {argument} 1337039846
• When ran without administrative privileges:
  • %System%\icacls.exe "C:\*" /grant:r Everyone:F /t /c /q - grant permission to access C directory

(Nota: %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random} = %Application Data%\{Random Name}\{Random Name}.exe

Otras modificaciones del sistema

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeCaption = Your network was hacked. Your ID: {ID}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeText = Your network was hacked. Your ID: {ID} DO NOT RESET OR SHUTDOWN your PC or server...DO NOT RENAME/ MOVE/ DELETE the encrypted and readme files Info:http://{BLOCKED}.onion/order/001f639d-ddcd-50a6-9b48-8ed9b1ec7448 {BLOCKED}port@protonmail.com....Ifyou decide not to cooperate your sensitive data will be shared to public at http://{BLOCKED}.onion ..and all the rest will remain unreachable to you

Rutina de adware

Este malware se elimina tras la ejecución.

Otros detalles

Hace lo siguiente:

• When ran with administrator privileges, it will do the following:
  • Adds the following service:
    Service Name: KProcessHacker3
    Image Path: %Application Data%\{Random}\{Random Name 2}
  • It tries to look for services running in the machine and tries to disable some of them. Below are some of the services it tries to disable:
    • SDRSVC
    • sstpsvc
    • StorSVC
    • swprv
    • wbengine
    • ui0detect
  • Based on the services it tries to look for in the machine, it will try to take ownership of this service using the following command:
    • %System%\takeown.exe /F %System%\{file name}.exe
    • %System%\icacls.exe %System%\{file name}.exe /reset
    • It will then rename the original file name to {file name}.exe-0, and replace the original file with its copy.
  • It will then restart the machine in safe mode and prevent the user from logging in
    
  • It renames the following file when found in the machine:
    • %Windows%\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe renamed to %Windows%\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe_
• When ran without administrator privileges, it will do the following:
  • It will only install its autorun registry when ran without administrative privileges
• It requires to be executed with the following argument in order to proceed with its malicious routine:
  • zTWqycy0yqmFLUBlyMF2859f
• It uses the following information to generate random characters for the file name it will drop:
  • Computer Name
• It enumerates registry keys to gather system information
• It will encrypt files found in the following set of drives in the affected system:
  • Network Drives
  • Fixed Drives
  • Removable Drives
• It uses the following set of commands to gather the network drives connected to the system and connect to the following network drives to encrypt it's files:
  • %System%\net.exe view igmp.mcast.net
  • %System%\arp.exe -a
  • %System%\nslookup.exe {IP address}
• It changes the passwords of all the users in the affected system