Ransom.Win64.HADES.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops a copy of itself in the following folders using different file names:

• %Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}\{String generated from HKLM\SOFTWARE\Microsoft subkeys}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• cmd /c waitfor /t 10 pause /d y & attrib -h "{MALWARE PATH}\{MALWARE NAME}.exe" & del "{MALWARE PATH}\{MALWARE NAME}.exe" & rd "{MALWARE PATH}"
• cmd /c waitfor /t 10 pause /d y & attrib -h "%Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}\{String generated from HKLM\SOFTWARE\Microsoft subkeys}" & del "%Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}\{String generated from HKLM\SOFTWARE\Microsoft subkeys}" & rd "%Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}"
• attrib -h "%Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}\{String generated from HKLM\SOFTWARE\Microsoft subkeys}"
• attrib -h "{MALWARE PATH}\{MALWARE NAME}.exe"

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It executes then deletes itself afterward.

It terminates the execution of the copy it initially executed and executes the copy it drops instead.

Other System Modifications

This Ransomware deletes the following folders:

• %Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Ransomware does the following:

• It deletes shadow copies by executing the following command:
  • vssadmin delete shadows /all /quiet

It accepts the following parameters:

• /path → Specifies directory to be encrypted
• /user → Execute without admin rights
• /uac → Execute with admin rights
• /prio → Execute as high priority process

It deletes the following files to remove its traces in the system:

• %Application Data%\{String generated from HKLM\SOFTWARE\Microsoft subkeys}\{String generated from HKLM\SOFTWARE\Microsoft subkeys}
• {MALWARE PATH}\{MALWARE NAME}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• .386
• .adv
• .bat
• .bin
• .cab
• .cmd
• .com
• .cpl
• .dat
• .dll
• .drv
• .exe
• .hlp
• .hta
• .icl
• .idx
• .ini
• .key
• .lnk
• .mod
• .msc
• .msi
• .msp
• .msu
• .nls
• .ocx
• .ps1
• .rom
• .rtp
• .scr
• .sdi
• .shs
• .sys
• .wim
• .wpx

It avoids encrypting files with the following strings in their file path:

• boot
• system volume information
• $recycle.bin
• webcache
• caches
• windowsapps
• appdata
• programdata
• users\all users
• bin
• boot
• boot
• dev
• etc
• lib
• initdr
• sbin
• sys
• vmlinuz
• run
• var
• c:\recovery\
• bootmgr
• grldr
• ntldr

It avoids encrypting files found in the following folders:

• %Windows%
• %Application Data%
• %User Temp%
• %All Users Profile%
• %Program Files%

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It appends the following extension to the file name of the encrypted files:

• .kgkq9

It drops the following file(s) as ransom note:

• {Encrypted Directory}/HOW-TO-DECRYPT-kgkq9.txt