Ransom.Win32.BITPAYMER.TGACAM

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops and executes the following files:

• %Application data%\{random}:bin -> Alternate Data Stream copy

It adds the following processes:

• %Application Data%\{random}:bin {malware path}\{malware name}.exe
• %System%\vssadmin.exe Delete Shadows /All /Quiet - to delete shadow copies
• %System%\diskshadow.exe /s %User Temp%\{random}.tmp - to delete shadow copies

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Ransomware does the following:

• It deletes the dropped alternate data stream copy %Application Data%\{random}:bin after execution.
• It does the following if it is not ran with administrative rights:
  • Adds the following files:
  %User Temp%\{random}.cmd -> command to start malware without prompt
  • Adds the following registry entries:
  HKEY_CLASSES_ROOT\MSCFile\shell\open\command
  = %system%\cmd.exe %User temp%\{random}.cmd
  • Run %System%\eventvwr.exe to execute the malware
  • It deletes both the added registry and dropped cmd file after execution
• It adds the following processes to obtain and map network and logical drivers, and encrypt the files in said drivers:
  • %System%\arp.exe -a
  • %System%\nslookup.exe {ip address}
• It looks for a legitimate service to hijack using the following:
  • %System%\takeown.exe /F {service path}\{service name}.exe
  • %System%\icacls.exe {service path}\{service name}.exe /reset
• After successfully hijacking the service, it will use alternate data stream and rename the legitimate service as {service name}:0. It will then rename itself as the hijacked service's name.

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It deletes the initially executed copy of itself

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• Caches
• WindowsApps
• System Volume Information
• AppData
• WebCache
• $RECYCLE.BIN

It avoids encrypting files found in the following folders:

• %Windows%
• %User Temp%
• %Application Data%

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It appends the following extension to the file name of the encrypted files:

• .{BLOCKED}bh

It drops the following file(s) as ransom note:

• {encrypted directory}\{encrypted file's name}.{BLOCKED}mbh_readme:
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .{BLOCKED}bh
• .{BLOCKED}bh_readme