Ransom.Win32.GEHENNALOCKER.THDAIBA

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Malware file path}\{Random characters}.bat (used to stop services and processes and delete shadow images)

It adds the following processes:

• cmd.exe /C "icacls . /grant Everyone:F /T /C /Q"
• cmd.exe /C "wbadmin delete catalog - quiet"
• cmd.exe /C "bcdedit /set { default } recoveryenabled no"
• cmd.exe /C "bcdedit /set { default } bootstatuspolicy ignoreallfailures"
• cmd.exe /C "wmic shadowcopy delete"
• cmd.exe /C "vssadmin delete shadows /All /Quiet"
• cmd /C {Random characters}.bat

Process Termination

This Ransomware terminates the following services if found on the affected system:

• MSSQL$PROD
• SQLAgent$PROD
• MSOLAP$TPS
• VeeamDeploySvc
• MSSQLServerOLAPService

It terminates the following processes if found running in the affected system's memory:

• avgidsagenta.exe
• avgcsrva.exe
• avgwdsvca.exe
• avgnsa.exe
• avgemca.exe
• avgrsa.exe
• egui.exe
• avpui.exe
• NS.exe
• ctfmon.exe
• processhacker.exe
• postgres.exe
• slqserver.exe
• sqlwriter.exe
• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• mydesktopqos.exe
• agntsvc.exe
• isqlplussvc.exe
• xfssvccon.exe
• mydesktopservice.exe

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• adx
• aes
• aif
• asc
• asm
• avi
• avx
• aw3
• bak
• bat
• bin
• bkp
• bmp
• bpl
• cfg
• cmd
• csv
• dbf
• dch
• dem
• der
• dip
• dir
• dmp
• doc
• end
• eps
• fin
• flv
• fma
• frm
• ftp
• gam
• gcg
• ifg
• pgp
• ght
• mhw
• pib
• dic
• oii
• fin
• iin
• tip
• 4jp
• gke
• yla
• yld
• fln
• klo
• glu
• am3
• um4
• am4
• vma
• pma
• xmd
• bmd
• fmi
• dmm
• lmo
• vmp
• 3mp
• 4mp
• amp
• gms
• gmy
• dmy
• ina
• nne
• sni
• lob
• jod
• bod
• cod
• god
• mod
• pod
• sod
• tot
• got
• sot
• tpa
• spc
• =pc
• tpd
• bpd
• dpd
• fpe
• mph
• ppn
• gpp
• spp
• tpr
• fps
• dpt
• rpt
• yra
• rra
• wro
• mrt
• fsa
• vsc
• hsl
• nsq
• lss
• hst
• csu
• osv
• gsx
• csx
• dsx
• ita
• rtb
• ktc
• ptg
• zti
• ftm
• ptx
• tud
• pvo
• bwa
• vwm
• awm
• vwp
• dwp
• sxl
• kxl
• rxl
• sxm
• lzi
• allg
• allp
• asn1
• avx2
• base
• bind
• bmi1
• bmi2
• bool
• call
• cas1
• cas2
• cas3
• cas4
• cas5
• cas6
• chan
• conf
• dead
• djvu
• docb
• docm
• docx
• eEpP
• epub
• erms
• file
• ftps
• func
• hour
• html
• http
• icmp
• idle
• igmp
• indd
• int8
• itab
• java
• jpeg
• kind
• lay6
• mpeg
• open
• path
• pipe
• pop3
• potm
• potx
• ppam
• pptm
• pptx
• prof
• quit
• read
• root
• sbrk
• sldm
• sldx
• smtp
• sse2
• sse3
• tag:
• tcp4
• tiff
• true
• udp4
• uint
• vmdk
• xlsm
• xlsx
• accdb
• array
• blend
• chdir
• close
• defer
• false
• fault
• gFree
• gcing
• gscan
• hchan
• https
• imap2
• imap3
• imaps
• int16
• int32
• int64
• mheap
• month
• ntohs
• panic
• pop3s
• scav
• sched
• sleep
• slice
• spine
• sse41
• sse42
• ssse3
• sudog
• svqxX
• sweep
• trace
• uint8
• usage
• write

It avoids encrypting files with the following strings in their file path:

• Program Files
• Program Files (x86)
• Windows
• Windows.old
• $WINDOWS.~BT
• Temp
• Fonts
• AppData
• $Recycle.Bin
• ProgramData
• bootmgr

It drops the following file(s) as ransom note:

• %Desktop%\GEHENNA-KEY-README.txt
• %Desktop%\GEHENNA-README-WARNING.html
• %Public%\GEHENNA-KEY-README.txt
• %Public%\GEHENNA-README-WARNING.html
• %System Root%\GEHENNA-KEY-README.txt
• %System Root%\GEHENNA-README-WARNING.html
• %System Root%\Users\GEHENNA-KEY-README.txt
• %System Root%\Users\GEHENNA-README-WARNING.html

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)