Ransom.Win32.PARADISE.E

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• vssadmin.exe delete shadows /all /quiet → deletes shadow copies
• "%System%\cmd.exe" /c ping 127.0.0.1 && del "{Malware Path}\{Malware Name}.exe" → deletes itself

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Ransomware drops the following file(s) in the Windows Common Startup folder to enable its automatic execution at every system startup:

• %User Startup%\{Random Characters}.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Process Termination

This Ransomware terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• mysql
• IBM
• bes10
• black
• sql
• store.exe
• vee
• postg
• sage

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• iplogger.org

It does the following:

• It disables Windows Defender by modifying the following registry entry:
  
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
    • DisableAntiSpyware = 1
      
• It deletes and terminates itself if the language of the target machine is any of the following:
  
  • Russian
  • Kazakh
  • Belarusian
  • Ukrainian
  • Tatar
• It encrypts files located in the following locations:
  
  • Removable Drives
  • Fixed Drives
  • Remote Drives

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• Windows
• $Recycle bin
• System Volume Information
• Program Files
• Program Files (x86)

It renames encrypted files using the following names:

• {File Name}.{File Extension}_babyfromparadise_{6 Random Characters}.777

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\---==%$$$OPEN_ME_UP$$$==---.txt