Ransom.Win32.MATRIX.AQDEE

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• {Malware directory}\{random characters}.exe

It drops the following files:

• %System%\Drivers\PROCEXP152.SYS
• {Malware directory}\{random characters}.exe → used for file handle manipulation
• {Malware directory}\ALL_dmp.fldp
• {Malware directory}\log.txt
• %Application Data%\{random characters}.bmp → used as wallpaper
• %Application Data%\{random characters}.bat → contains commands to remove volume shadow copies and disable system recovery
• %Application Data%\{random characters}.vbs → contains commands to create scheduled task
• {Malware directory}\{random characters}.bat → contains commands to take ownership of a file

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%System%\cmd.exe" /C copy /V /Y "{Malware directory}\{malware name}.exe" "{Malware directory}\{random characters}.exe";
• "{Malware directory}\{random characters}.exe" -n;
• %System%\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%Application Data%\{random characters}.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f;
• "%System%\cmd.exe" /C wscript //B //Nologo "%Application Data%\{random characters}.vbs";
• "%System%\cmd.exe" /C schtasks /Create /tn DSHCA /tr "%Application Data%\{random characters}.bat" /sc minute /mo 5 /RL HIGHEST /F;
• "%System%\cmd.exe" /C schtasks /Run /I /tn DSHCA;
• cmd /c ""{Malware directory}\{random characters}.bat" "%System Root%\Users\All Users\Microsoft\RAC\StateData\RacDatabase.sdf"";
• cacls "%System Root%\Users\All Users\Microsoft\RAC\StateData\RacDatabase.sdf" /E /G Machine Name:F /C;
• takeown /F "%System Root%\Users\All Users\Microsoft\RAC\StateData\RacDatabase.sdf";
• {random characters}.exe -accepteula "RacDatabase.sdf" -nobanner;

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• MutexTRU8

Other System Modifications

This Ransomware changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Application Data%\{random characters}.bmp

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 0

HKEY_CURRENT_USER\Control Panel\Desktop
TileWallpaper = 0

It sets the system's desktop wallpaper to the following image:

Backdoor Routine

This Ransomware connects to the following websites to send and receive information:

• http://tru.{BLOCKED}sday.org

Information Theft

This Ransomware gathers the following data:

• Computer name
• User name
• System Integrity Level
• Available Drives and Drive Data

Other Details

This Ransomware encrypts files with the following extensions:

• .MDF
• .NDF
• .LDF
• .MYD
• .EQL
• .SQL
• .VHD
• .SQLITE
• .SQLITE3
• .SQLITEDB
• .HWP
• .HWT
• .HML
• .HWDT
• .HWPX
• .CELL
• .NXL
• .HCDT
• .NXT
• .SHOW
• .HPT
• .HSDT
• .XLSX
• .XLS
• .DOCX
• .DOC
• .DOT
• .DOTX
• .ODT
• .ODS
• .BAK
• .TIB
• .DBS
• .DB
• .DBK
• .DB2
• .DB3
• .DBC
• .DT
• .DBS
• .DBF
• .DBX
• .MDB
• .SDF
• .NDF
• .NS2
• .NS3
• .NS4
• .NSF
• .ACCDB
• .VPD
• .DWG
• .CDR
• .PDF
• .JPEG
• .PSD
• .ZIP
• .RAR
• .7Z
• .TAR
• .GZ

It does the following:

• It deletes the scheduled task with the following task name:
  • DSHCA

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• NTUSER.DAT
• NTUSER.POL
• NTUSER.DAT.LOG
• NTUSER.DAT.LOG1
• NTUSER.DAT.LOG2
• ICONCACHE.DB
• THUMBS.DB
• BOOTSECT.BAK
• BOOTMGR
• DEFAULT.RDP
• PAGEFILE.SYS
• HIBERFIL.SYS
• SWAPFILE.SYS
• WORDPAD.EXE

It avoids encrypting files with the following strings in their file path:

• (X86)\ACRONIS\
• (X86)\BACKUP MANAGER\
• (X86)\BACKUPCLIENT\
• (X86)\CARBONITE\
• (X86)\DROPBOX\
• (X86)\GOOGLE\DRIVE\
• (X86)\MICROSOFT ONEDRIVE\
• (X86)\ONEDRIVE\
• \$RECYCLE.BIN\
• \7-ZIP\
• \ASPNET_CLIENT\
• \AVAST
• \AVDEFENDER
• \AVG
• \BITDEFENDER
• \BOOT\
• \COMMON FILES\
• \DEFAULT USER\
• \DVD MAKER\
• \ESET
• \INTERNET EXPLORER\
• \KASPERSKY LAB
• \KASPERSKYLAB
• \MALWAREBYTES
• \MCAFEE
• \MICROSOFT OFFICE\
• \MICROSOFT SILVERLIGHT\
• \MICROSOFT\CRYPTO\
• \MICROSOFT\OFFICE\
• \MICROSOFT\PROVISIONING\
• \MSOCACHE\
• \PANDA SECURITY
• \PROGRAMDATA\MICROSOFT\
• \REFERENCE ASSEMBLIES\
• \SOPHOS
• \SYMANTEC ENDPOINT
• \TEMP\
• \TOR BROWSER\
• \TREND MICRO
• \WINDOWS DEFENDER\
• \WINDOWS MEDIA PLAYER\
• \WINDOWS NT\
• \WINDOWS SIDEBAR\
• \WINDOWS.OLD\
• \WINDOWS10UPGRADE\
• \WINDOWS\
• \WINDOWSAPPS\
• \WINDOWSPOWERSHELL\
• \WINRAR\
• FILES\ACRONIS\
• FILES\BACKUP MANAGER\
• FILES\BACKUPCLIENT\
• FILES\CARBONITE\
• FILES\DROPBOX\
• FILES\GOOGLE\DRIVE\
• FILES\MICROSOFT ONEDRIVE\
• FILES\ONEDRIVE\

It renames encrypted files using the following names:

• [TRU888@QQ.COM].{8 Random Characters}-{8 Random Characters}.TRU8

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\!README_TRU8!.rtf
• 
  
  

It avoids encrypting files with the following file extensions:

• .VBS
• .RTF
• .BMP
• .TMP
• .RDP
• .SEK
• .ICO
• .DLL
• .BLF
• .RBS
• .REGTRANS-MS
• .SETTINGCONTENT-MS
• .SEARCH-MS
• .LOG
• .XML
• .LOG1
• .LOG2