Ransom.Win32.LOKILOCKER.YXBIG

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\{Random characters}.loki -> set as the desktop background
• {Malware directory}\logs.txt -> logs information regarding the sample's operation

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• vssadmin delete shadows /all /quiet
• wmic shadowcopy delete
• wbadmin delete catalog -quiet
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• bcdedit /set {default} recoveryenabled no
• netsh advfirewall set currentprofile state off
• netsh firewall set opmode mode=disable

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• LokiLocker

Autostart Technique

This Ransomware drops the following files:

• %User Startup%\winlogon.exe
• %Common Startup%\winlogon.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).. %Common Startup% is the startup folder for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Loki

HKEY_CURRENT_USER\Software\Loki
public = {hex bytes}

HKEY_CURRENT_USER\Software\Loki
full = {hex bytes}

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real Time Protection
DisableOnAccessProtection = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real Time Protection
DisableScanOnRealtimeEnable = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
legalnoticecaption = Encrypted by Loki locker

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\OEMInformation
Manufacturer = Encrypted by Loki locker

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\OEMInformation
SupportPhone = All your files have been encrypted . . . . . . . @ProtonMail.Com

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{Random characters}.loki

Process Termination

This Ransomware terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• wxserver
• wxserverview
• sqlservr
• ragui
• supervise
• culture
• rtvscan
• defwatch
• sqlbrowser
• winword
• qbw32
• qbdbmgr
• qbupdate
• qbcfmonitorservice
• axlbridge
• qbidpservice
• httpd
• fdlauncher
• msdtsrvr
• tomcat6
• zhudongfangyu
• vmware-usbarbitator64
• vmware-converter
• dbsrv12
• notepad
• defwatch
• ccevtmgr
• ccsetmgr
• savroam
• sqlserv
• sqlagent
• sqladhlp
• culserver
• rtvscan
• sqlbrowser
• sqladhlp
• qbidpservice
• quickboooks.fcs
• qbcfmonitorservice
• sqlwriter
• msmdsrv
• tomcat6
• zhundongfangyu
• vmware-usbarbitator64
• vmware-converter
• dbsrv12
• dbeng8
• wrapper
• mssqlserver
• mssql$contoso1
• msdtc
• sqlserveragent
• vds

Information Theft

This Ransomware gathers the following data:

• Unique ID
• Disk Space

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}cker.one/index.php

Other Details

This Ransomware does the following:

• It checks for 'loki.txt' as its configuration file:
  
• loki.txt contains the following configurations:
  • nocdrive
  • update
  • nostartup
  • disabletask
  • clast
  • norun
  • shutdown
• It empties the recycle bin
• It changes the encrypted volume name to:
  • Locked by Loki {Volume name}
• It shows the following message box after its encryption:
  
• It changes the Legal Notice Caption and Legal Notice Text to the following:
  

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• boot.ini
• bootfont.bin
• ntldr
• ntdetect.com
• io.sys

It renames encrypted files using the following names:

• [DecNow@TutaMail.com][{UID}]{original filename}.{original extension}.Loki

It drops the following file(s) as ransom note:

• {Encrypted folder}\Restore-My-Files.txt
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .com
• .msi
• .Loki