Ransom.Win32.Exorcist.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• wmic.exe SHADOWCOPY DELETE /nointeractive
• wbadmin DELETE SYSTEMSTATEBACKUP
• wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
• bcdedit.exe /set {default} recoveryenabled No
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• vssadmin.exe Delete Shadows /All /Quiet
• C:\Windows\system32\vssvc.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• KgexAmqjYXQWQuk2Zaoqci0hs9jr77UsuVmF751

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

Process Termination

This Ransomware terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• MSSQL$MICROSOFT##WID*
• wxServer*
• wxServerView*
• sqlmangr*
• RAgui*
• supervise*
• Culture*
• Defwatch*
• winword*
• QBW32*
• QBDBMgr*
• qbupdate*
• axlbridge*
• httpd*
• fdlauncher*
• MsDtSrvr*
• java*
• 360se*
• 360doctor*
• wdswfsafe*
• fdhost*
• GDscan*
• ZhuDongFangYu*
• QBDBMgrN*
• mysqld*
• AutodeskDesktopApp*
• acwebbrowser*
• Creative Cloud*
• Adobe Desktop Service*
• CoreSync*
• Adobe CEF Helper*
• node*
• AdobeIPCBroker*
• sync-taskbar*
• sync-worker*
• InputPersonalization*
• AdobeCollabSync*
• BrCtrlCntr*
• BrCcUxSys*
• SimplyConnectionManager*
• Simply.SystemTrayIcon*
• fbguard*
• fbserver*
• ONENOTEM*
• wrapper*
• DefWatch*
• ccEvtMgr*
• ccSetMgr*
• SavRoam*
• Sqlservr*
• sqlagent*
• sqladhlp*
• Culserver*
• RTVscan*
• sqlbrowser*
• SQLADHLP*
• QBIDPService*
• Intuit.QuickBooks.FCS*
• QBCFMonitorService*
• sqlwriter*
• msmdsrv*
• tomcat6*
• zhudongfangyu*
• vmware-usbarbitator64*
• vmware-converter*
• dbsrv12*
• dbeng8*
• MSSQL$VEEAMSQL2012*
• SQLAgent$VEEAMSQL2012*
• SQLBrowser*
• SQLWriter*
• FishbowlMySQL*
• MySQL57*
• MSSQL$KAV_CS_ADMIN_KIT*
• MSSQLServerADHelper100*
• SQLAgent$KAV_CS_ADMIN_KIT*
• msftesql-Exchange*
• MSSQL$MICROSOFT##SSEE*
• MSSQL$SBSMONITORING*
• MSSQL$SHAREPOINT*
• MSSQLFDLauncher$SBSMONITORING*
• MSSQLFDLauncher$SHAREPOINT*
• SQLAgent$SBSMONITORING*
• SQLAgent$SHAREPOINT*
• QBFCService*
• QBVSS*

Information Theft

This Ransomware gathers the following data:

• User ID
• Build ID
• Appended Extension
• OS Version
• User Name
• Computer Name
• RSA Key
• Local Information
• Is user admin
• Is system a server
• Does system have ru keys
• OS Architecture

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}.{BLOCKED}.117.26:80

Other Details

This Ransomware does the following:

• It will not perform its ransomware routine if the geolocation of affected system is any of the following:
  • russian
  • armenian
  • belarusian
  • georgian
  • kazakh
  • tajik
  • turkmen
  • ukrainian
  • uzbek
  • azerbaijani
• Executes the following command if the above condition is satisfied:
  • """%system%\cmd.exe"" /C timeout /T 15 /NOBREAK && del ""{Malware Directory}\{Malware Name}.exe"" /F"

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• C:\autoexec.bat
• \bootfont.bin
• \boot.ini
• \desktop.ini
• \iconcache.db
• \ntldr
• \thumbs.db
• \bootsect.bak
• \bootmgr
• \ntuser.ini
• \autorun.inf

It avoids encrypting files with the following strings in their file path:

• C:\$Recycle.Bin\
• \$windows.~bt\
• \intel\
• \msocache\
• \$recycle.bin\
• \$windows.~ws\
• \tor browser\
• \boot\
• \windows\
• \windows nt\
• \msbuild\
• \microsoft\
• \all users\
• \system volume information\
• \google\
• \windows.old\
• \mozilla\
• \appdata\local\
• \appdata\locallow\
• \appdata\roaming\
• \programdata\
• \perflogs\
• \program files\
• \program files (x86)\

It appends the following extension to the file name of the encrypted files:

• .{6 random characters}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\{6 Random Characters}-decrypt.hta
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .sys
• .hta
• .386
• .cmd
• .ani
• .adv
• .theme
• .themepack
• .deskthemepack
• .nomedia
• .msi
• .msp
• .com
• .diagpkg
• .nls
• .diagcab
• .lock
• .ocx
• .mpa
• .cpl
• .mod
• .icns
• .prf
• .rtp
• .diagcfg
• .msstyles
• .rdp
• .bin
• .hlp
• .shs
• .drv
• .wpx
• .bat
• .rom
• .msc
• .spl
• .ps1
• .msu
• .ics
• .key
• .lnk
• .ico
• .cur
• .idx
• .ini
• .reg