Ransom.Win64.GONNACRYPT.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

However, as of this writing, the said sites are inaccessible.

It encrypts files with specific file extensions. It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %User Profile%\WindowsSecurityUpdate.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• {Malware Filepath}\{Malware Filename} → If not run as admin
• tasklist /FO csv
• cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -q
• cmd /c bcdedit /set {default} recoveryenabled No
• cmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
• cmd /C vssadmin.exe Delete Shadows /All Quiet
• cmd /c REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
• cmd /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Security Update" /t REG_SZ /d "C:\Users\dyituser_764\WindowsSecurityUpdate.exe /onboot" /f
• After performing its Encryption and Information Theft routines:
  • cmd /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer /v NoRun /t REG_DWORD /d 1 /f
  • cmd /c sc stop VVS & sc stop wscsvc & sc stop WinDefend & sc stop wuauserv & sc stop BITS & sc stop ERSvc & sc stop WerSvc

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Security Update = %User Profile%\WindowsSecurityUpdate.exe /onboot

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Infected = {Malware Defined Value}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
NoRun = 1

It adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

Process Termination

This Ransomware terminates the following services if found on the affected system:

• After performing its Encryption and Information Theft routines:
  • VVS
  • wscsvc
  • WinDefend
  • wuauserv
  • BITS
  • ERSvc
  • WerSvc

Information Theft

This Ransomware gathers the following data:

• Username
• IP Address
• Local Time

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• https://icanhazip.com → Accessible

It does the following:

• It connects to the following URL to download its component file:
  • https://{BLOCKED}.org/lyuiRne.png → %User Temp%\lyuiRne.png (To be used as wallpaper)
• It sends the gathered information to the following URL:
  • https://{BLOCKED}.org/695509141f3712df6449e25597e8e59c.php

However, as of this writing, the said sites are inaccessible.

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .3dm
• .3ds
• .3g2
• .3gp
• .7z
• .accdb
• .ai
• .aif
• .apk
• .arj
• .aspx
• .avi
• .bak
• .bat
• .bkp
• .blend
• .bmp
• .c
• .cab
• .cbr
• .cc
• .cfg
• .cgi
• .conf
• .crx
• .csv
• .cur
• .dat
• .db
• .dbf
• .deb
• .dem
• .dif
• .dll
• .doc
• .docm
• .docx
• .dotx
• .eps
• .epub
• .exe
• .flv
• .fon
• .gam
• .gif
• .go
• .gz
• .h
• .html
• .icns
• .ico
• .iif
• .indd
• .ini
• .jar
• .java
• .jpeg
• .jpg
• .js
• .jsp
• .jspx
• .key
• .keychain
• .lua
• .m3u
• .m4a
• .M4P
• .m4v
• .M4V
• .max
• .mdb
• .mid
• .mkv
• .mov
• .mp3
• .mp4
• .MP4
• .mpa
• .mpg
• .msg
• .msi
• .nes
• .obj
• .odt
• .pct
• .pdb
• .pdf
• .php
• .pkg
• .pl
• .plugin
• .png
• .pps
• .ppt
• .pptm
• .pptx
• .prf
• .ps
• .psd
• .py
• .rar
• .rom
• .rs
• .rtf
• .sav
• .sdf
• .sh
• .sln
• .sql
• .sqlite
• .svg
• .tar
• .tar.gz
• .tif
• .tmp
• .ttf
• .txt
• .VB
• .vob
• .wav
• .wma
• .wmv
• .wpd
• .wps
• .xlr
• .xls
• .xlsx
• .xml
• .yaws
• .zip

It avoids encrypting files with the following strings in their file path:

• $Recycle.Bin
• $WINDOWS.~BT
• AppData
• bootmgr
• Program Files
• Program Files (x86)
• ProgramData
• Windows
• Windows.old

It appends the following extension to the file name of the encrypted files:

• .GoNNaCry

It drops the following file(s) as ransom note:

• %Desktop%\GoNNaCry.html
  

It avoids encrypting files with the following file extensions:

• .GoNNaCry
• .html