Ransom.Win64.RYUK.SM

Infection Channel: Dropped by other malware, Downloaded from the Internet

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Payload: Terminates processes, Displays graphics/image, Encrypts files

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

%System Root%\users\Public\sys
%System Root%\users\Public\PUBLIC
%System Root%\users\Public\UNIQUE_ID_DO_NOT_REMOVE
%System Root%\users\Public\window.bat <-Uses to delete shadow copies and backup.

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

infopath.exe
zoolzz.exe
dbeng50.exe
encsv.exe
excel.exe
msaccess.exe
msftesql.exe
mspub.exe
mydesktopqos.exe
mydesktopservice.exe
mysqld.exe
mysqld-nt.exe
mysqld-opt.exe
ocautoupds.exe
ocomm.exe
ocssd.exe
onenote.exe
oracle.exe
outlook.exe
powerpnt.exe
sqbcoreservice.exe
sqlagent.exe
sqlbrowser.exe
sqlservr.exe
sqlwriter.exe
steam.exe
synctime.exe
tbirdconfig.exe
thebat.exe
thebat64.exe
thunderbird.exe
visio.exe
winword.exe
wordpad.exe
xfssvccon.exe
tmlisten.exe
PccNTMon.exe
CNTAoSMgr.exe
Ntrtscan.exe
mbamtray.exe

Other Details

This Ransomware does the following:

Executes the following to stop the following services:
- net stop "Acronis VSS Provider" /y
- net stop "Enterprise Client Service" /y
- net stop "Sophos Agent" /y
- net stop "Sophos AutoUpdate Service" /y
- net stop "Sophos Clean Service" /y
- net stop "Sophos Device Control Service" /y
- net stop "Sophos File Scanner Service" /y
- net stop "Sophos Health Service" /y
- net stop "Sophos MCS Agent" /y
- net stop "Sophos MCS Client" /y
- net stop "Sophos Message Router" /y
- net stop "Sophos Safestore Service" /y
- net stop "Sophos System Protection Service" /y
- net stop "Sophos Web Control Service" /y
- net stop "SQLsafe Backup Service" /y
- net stop "SQLsafe Filter Service" /y
- net stop "Symantec System Recovery" /y
- net stop "Veeam Backup Catalog Data Service" /y
- net stop AcronisAgent /y
- net stop AcrSch2Svc /y
- net stop Antivirus /y
- net stop ARSM /y
- net stop "audioendpointbuilder" /y
- net stop BackupExecAgentAccelerator /y
- net stop BackupExecAgentBrowser /y
- net stop BackupExecDeviceMediaService /y
- net stop BackupExecJobEngine /y
- net stop BackupExecManagementService /y
- net stop BackupExecRPCService /y
- net stop BackupExecVSSProvider /y
- net stop bedbg /y
- net stop DCAgent /y
- net stop EPSecurityService /y
- net stop EPUpdateService /y
- net stop EraserSvc11710 /y
- net stop EsgShKernel /y
- net stop FA_Scheduler /y
- net stop IISAdmin /y
- net stop IMAP4Svc /y
- net stop macmnsvc /y
- net stop masvc /y
- net stop MBAMService /y/li>
- net stop MBEndpointAgent /y
- net stop McAfeeEngineService /y
- net stop McAfeeFramework /y
- net stop McAfeeFrameworkMcAfeeFramework /y
- net stop McShield /y
- net stop McTaskManager /y
- net stop mfemms /y
- net stop mfevtp /y
- net stop MMS /y
- net stop mozyprobackup /y
- net stop MsDtsServer /y
- net stop MsDtsServer100 /y
- net stopMsDtsServer110 /y
- net stop MSExchangeES /y
- net stop MSExchangeIS /y
- net stop MSExchangeMGMT /y
- net stop MSExchangeMTA /y
- net stop MSExchangeSA /y
- net stop MSExchangeSRS /y
- net stop MSOLAP$SQL_2008 /y
- net stop MSOLAP$SYSTEM_BGC /y
- net stop MSOLAP$TPS /y
- net stop MSOLAP$TPSAMA /y
- net stop MSSQL$BKUPEXEC /y
- net stop MSSQL$ECWDB2 /y
- net stop MSSQL$PRACTICEMGT /y
- net stop MSSQL$PRACTTICEBGC /y
- net stop MSSQL$PROFXENGAGEMENT /y
- net stop MSSQL$SBSMONITORING /y
- net stop MSSQL$SHAREPOINT /y
- net stop MSSQL$SQL_2008 /y
- net stop MSSQL$SYSTEM_BGC /y
- net stop MSSQL$TPS /y
- net stop MSSQL$TPSAMA /y
- net stop MSSQL$VEEAMSQL2008R2 /y
- net stop MSSQL$VEEAMSQL2012 /y
- net stop MSSQLFDLauncher /y
- net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
- net stop MSSQLFDLauncher$SBSMONITORING /y
- net stop MSSQLFDLauncher$SHAREPOINT /y
- net stop MSSQLFDLauncher$SQL_2008 /y
- net stop MSSQLFDLauncher$SYSTEM_BGC /y
- net stop MSSQLFDLauncher$TPS /y
- net stop MSSQLFDLauncher$TPSAMA /y
- net stop MSSQLSERVER /y
- net stop MSSQLServerADHelper100 /y
- net stop MSSQLServerOLAPService /y
- net stop MySQL80 /y
- net stop MySQL57 /y
- net stop ntrtscan /y
- net stop OracleClientCache80 /y
- net stop PDVFSService /y
- net stop POP3Svc /y
- net stop ReportServer /y
- net stop ReportServer$SQL_2008 /y
- net stop ReportServer$SYSTEM_BGC /y
- net stop ReportServer$TPS /y
- net stop ReportServer$TPSAMA /y
- net stop RESvc /y
- net stop sacsvr /y
- net stop SamSs /y
- net stop SAVAdminService /y
- net stop SAVService /y
- net stop SDRSVC /y
- net stop SepMasterService /y
- net stop ShMonitor /y
- net stop Smcinst /y
- net stop SmcService /y
- net stop SMTPSvc /y
- net stop SNAC /y
- net stop SntpService /y
- net stop sophossps /y
- net stop SQLAgent$BKUPEXEC /y
- net stop SQLAgent$ECWDB2 /y
- net stop SQLAgent$PRACTTICEBGC /y
- net stop SQLAgent$PRACTTICEMGT /y
- net stop SQLAgent$PROFXENGAGEMENT /y
- net stop SQLAgent$SBSMONITORING /y
- net stop SQLAgent$SHAREPOINT /y
- net stop SQLAgent$SQL_2008 /y
- net stop SQLAgent$SYSTEM_BGC /y
- net stop SQLAgent$TPS /y
- net stop SQLAgent$TPSAMA /y
- net stop SQLAgent$VEEAMSQL2008R2 /y
- net stop SQLAgent$VEEAMSQL2012 /y
- net stop SQLBrowser /y
- net stop SQLSafeOLRService /y
- net stop SQLSERVERAGENT /y
- net stop SQLTELEMETRY /y
- net stop SQLTELEMETRY$ECWDB2 /y
- net stop SQLWriter /y
- net stop SstpSvc /y
- net stop svcGenericHost /y
- net stop swi_filter /y
- net stop swi_service /y
- net stop swi_update_64 /y
- net stop TmCCSF /y
- net stop tmlisten /y
- net stop TrueKey /y
- net stop TrueKeyScheduler /y
- net stop TrueKeyServiceHelper /y
- net stop UI0Detect /y
- net stop VeeamBackupSvc /y
- net stop VeeamBrokerSvc /y
- net stop VeeamCatalogSvc /y
- net stop VeeamCloudSvc /y
- net stop VeeamDeploymentService /y
- net stop VeeamDeploySvc /y
- net stop VeeamEnterpriseManagerSvc /y
- net stop VeeamMountSvc /y
- net stop VeeamNFSSvc /y
- net stop VeeamRESTSvc /y
- net stop VeeamTransportSvc /y
- net stop W3Svc /y
- net stop wbengine /y
- net stop WRSVC /y
- net stop MSSQL$VEEAMSQL2008R2 /y
- net stop SQLAgent$VEEAMSQL2008R2 /y
- net stop VeeamHvIntegrationSvc /y
- net stop swi_update /y
- net stop SQLAgent$CXDB /y
- net stop SQLAgent$CITRIX_METAFRAME /y
- net stop "SQL Backups" /y
- net stop MSSQL$PROD /y
- net stop "Zoolz 2 Service" /y
- net stop MSSQLServerADHelper /y
- net stop SQLAgent$PROD /y
- net stop msftesql$PROD /y
- net stop NetMsmqActivator /y
- net stop EhttpSrv /y
- net stop ekrn /y
- net stop ESHASRV /y
- net stop MSSQL$SOPHOS /y
- net stop SQLAgent$SOPHOS /y
- net stop AVP /y
- net stop klnagent /y
- net stop MSSQL$SQLEXPRESS /y
- net stop SQLAgent$SQLEXPRESS /y
- net stop wbengine /y
- net stop kavfsslp /y
- net stop KAVFSGT /y
- net stop KAVFS /y
- net stop mfefire /y
Injects to all running processes except for the following:
- csrss.exe
- explorer.exe
- lsaas.exe

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

.RYK

It drops the following file(s) as ransom note:

{Encrypted Directory}\RyukReadMe.html

Minimum Scan Engine: 9.850

FIRST VSAPI PATTERN FILE: 15.124.08

FIRST VSAPI PATTERN DATE: 21 May 2019

VSAPI OPR PATTERN File: 15.125.00

VSAPI OPR PATTERN Date: 22 May 2019

Step 1

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 2

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Search and delete these files

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%System Root%\users\Public\sys
%System Root%\users\Public\PUBLIC
%System Root%\users\Public\UNIQUE_ID_DO_NOT_REMOVE
%System Root%\users\Public\window.bat <-Uses to delete shadow copies and backup.
{Encrypted Directory}\RyukReadMe.html

Step 5

Restart in normal mode and scan your computer with your Trend Micro product for files detected as Ransom.Win64.RYUK.SM. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 6

Restore encrypted files from backup.

Did this description help? Tell us how we did.

OVERVIEW

TECHNICAL DETAILS

SOLUTION