Ransom.Win32.MIMIC.SMZTJJ-A

INFECTION CHANNEL: Descargado de Internet, Eliminado por otro tipo de malware

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina entradas de registro para causar el funcionamiento incorrecto de aplicaciones y programas.

File size: 2,453,740 bytes

File type: EXE

Memory resident: Yes

INITIAL SAMPLES RECEIVED DATE: 17 de января de 2023

PAYLOAD: Drops files, Terminates processes, Deletes files, Encrypts files

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

{All affected directories}\Decrypt_me.txt
%User Temp%\session.tmp
%AppDataLocal%\{GUID}\bestplacetolive.exe
%AppDataLocal%\{GUID}\session.tmp
%User Temp%\{random letters}.{random letters}.ps1
%User Temp%\{random letters}.{random letters}.psm1
%AppDataLocal%\{GUID}\Everything32.dll

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

)

Agrega los procesos siguientes:

"%AppDataLocal%\{GUID}\bestplacetolive.exe"
"%AppDataLocal%\{GUID}\bestplacetolive.exe" -e watch -pid {PID of bestplacetolive.exe} -!
"%AppDataLocal%\{GUID}\bestplacetolive.exe" -e ul1
"%AppDataLocal%\{GUID}\bestplacetolive.exe" -e ul2
powercfg.exe -H off
powercfg.exe -SETACVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 1} 0
powercfg.exe -SETACVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 2} 0
powercfg.exe -SETACVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 3} 0
powercfg.exe -SETDCVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 1} 0
powercfg.exe -SETDCVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 2} 0
powercfg.exe -SETDCVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 3} 0
powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 1} 0
powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 2} 0
powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 3} 0
powercfg.exe -SETDCVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 1} 0
powercfg.exe -SETDCVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 2} 0
powercfg.exe -SETDCVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 3} 0
powercfg.exe -S {Power scheme GUID}
powercfg.exe -S {Power scheme GUID 2}
powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
cmd.exe /c DC.exe /D

Crea las carpetas siguientes:

%AppDataLocal%\{GUID}
%System Root%\temp

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

)

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

iitiitLavvoiteaieii

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
bestplacetolive = "%AppDataLocal%\{GUID}\bestplacetolive.exe"

Otras modificaciones del sistema

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\VSS
Start = 4