Ransom.Win64.RYUK.SM
Ransom:Win64/Ryuk.PA!MTB(Microsoft); Trojan-Ransom.Win32.Encoder.cpj(Kaspersky)
Windows
Threat Type: Ransomware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It drops files as ransom note.
TECHNICAL DETAILS
Arrival Details
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Ransomware drops the following files:
- %System Root%\users\Public\sys
- %System Root%\users\Public\PUBLIC
- %System Root%\users\Public\UNIQUE_ID_DO_NOT_REMOVE
- %System Root%\users\Public\window.bat <-Uses to delete shadow copies and backup.
(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)
Process Termination
This Ransomware terminates the following processes if found running in the affected system's memory:
- infopath.exe
- zoolzz.exe
- dbeng50.exe
- encsv.exe
- excel.exe
- msaccess.exe
- msftesql.exe
- mspub.exe
- mydesktopqos.exe
- mydesktopservice.exe
- mysqld.exe
- mysqld-nt.exe
- mysqld-opt.exe
- ocautoupds.exe
- ocomm.exe
- ocssd.exe
- onenote.exe
- oracle.exe
- outlook.exe
- powerpnt.exe
- sqbcoreservice.exe
- sqlagent.exe
- sqlbrowser.exe
- sqlservr.exe
- sqlwriter.exe
- steam.exe
- synctime.exe
- tbirdconfig.exe
- thebat.exe
- thebat64.exe
- thunderbird.exe
- visio.exe
- winword.exe
- wordpad.exe
- xfssvccon.exe
- tmlisten.exe
- PccNTMon.exe
- CNTAoSMgr.exe
- Ntrtscan.exe
- mbamtray.exe
Other Details
This Ransomware does the following:
- Executes the following to stop the following services:
- net stop "Acronis VSS Provider" /y
- net stop "Enterprise Client Service" /y
- net stop "Sophos Agent" /y
- net stop "Sophos AutoUpdate Service" /y
- net stop "Sophos Clean Service" /y
- net stop "Sophos Device Control Service" /y
- net stop "Sophos File Scanner Service" /y
- net stop "Sophos Health Service" /y
- net stop "Sophos MCS Agent" /y
- net stop "Sophos MCS Client" /y
- net stop "Sophos Message Router" /y
- net stop "Sophos Safestore Service" /y
- net stop "Sophos System Protection Service" /y
- net stop "Sophos Web Control Service" /y
- net stop "SQLsafe Backup Service" /y
- net stop "SQLsafe Filter Service" /y
- net stop "Symantec System Recovery" /y
- net stop "Veeam Backup Catalog Data Service" /y
- net stop AcronisAgent /y
- net stop AcrSch2Svc /y
- net stop Antivirus /y
- net stop ARSM /y
- net stop "audioendpointbuilder" /y
- net stop BackupExecAgentAccelerator /y
- net stop BackupExecAgentBrowser /y
- net stop BackupExecDeviceMediaService /y
- net stop BackupExecJobEngine /y
- net stop BackupExecManagementService /y
- net stop BackupExecRPCService /y
- net stop BackupExecVSSProvider /y
- net stop bedbg /y
- net stop DCAgent /y
- net stop EPSecurityService /y
- net stop EPUpdateService /y
- net stop EraserSvc11710 /y
- net stop EsgShKernel /y
- net stop FA_Scheduler /y
- net stop IISAdmin /y
- net stop IMAP4Svc /y
- net stop macmnsvc /y
- net stop masvc /y
- net stop MBAMService /y/li>
- net stop MBEndpointAgent /y
- net stop McAfeeEngineService /y
- net stop McAfeeFramework /y
- net stop McAfeeFrameworkMcAfeeFramework /y
- net stop McShield /y
- net stop McTaskManager /y
- net stop mfemms /y
- net stop mfevtp /y
- net stop MMS /y
- net stop mozyprobackup /y
- net stop MsDtsServer /y
- net stop MsDtsServer100 /y
- net stopMsDtsServer110 /y
- net stop MSExchangeES /y
- net stop MSExchangeIS /y
- net stop MSExchangeMGMT /y
- net stop MSExchangeMTA /y
- net stop MSExchangeSA /y
- net stop MSExchangeSRS /y
- net stop MSOLAP$SQL_2008 /y
- net stop MSOLAP$SYSTEM_BGC /y
- net stop MSOLAP$TPS /y
- net stop MSOLAP$TPSAMA /y
- net stop MSSQL$BKUPEXEC /y
- net stop MSSQL$ECWDB2 /y
- net stop MSSQL$PRACTICEMGT /y
- net stop MSSQL$PRACTTICEBGC /y
- net stop MSSQL$PROFXENGAGEMENT /y
- net stop MSSQL$SBSMONITORING /y
- net stop MSSQL$SHAREPOINT /y
- net stop MSSQL$SQL_2008 /y
- net stop MSSQL$SYSTEM_BGC /y
- net stop MSSQL$TPS /y
- net stop MSSQL$TPSAMA /y
- net stop MSSQL$VEEAMSQL2008R2 /y
- net stop MSSQL$VEEAMSQL2012 /y
- net stop MSSQLFDLauncher /y
- net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
- net stop MSSQLFDLauncher$SBSMONITORING /y
- net stop MSSQLFDLauncher$SHAREPOINT /y
- net stop MSSQLFDLauncher$SQL_2008 /y
- net stop MSSQLFDLauncher$SYSTEM_BGC /y
- net stop MSSQLFDLauncher$TPS /y
- net stop MSSQLFDLauncher$TPSAMA /y
- net stop MSSQLSERVER /y
- net stop MSSQLServerADHelper100 /y
- net stop MSSQLServerOLAPService /y
- net stop MySQL80 /y
- net stop MySQL57 /y
- net stop ntrtscan /y
- net stop OracleClientCache80 /y
- net stop PDVFSService /y
- net stop POP3Svc /y
- net stop ReportServer /y
- net stop ReportServer$SQL_2008 /y
- net stop ReportServer$SYSTEM_BGC /y
- net stop ReportServer$TPS /y
- net stop ReportServer$TPSAMA /y
- net stop RESvc /y
- net stop sacsvr /y
- net stop SamSs /y
- net stop SAVAdminService /y
- net stop SAVService /y
- net stop SDRSVC /y
- net stop SepMasterService /y
- net stop ShMonitor /y
- net stop Smcinst /y
- net stop SmcService /y
- net stop SMTPSvc /y
- net stop SNAC /y
- net stop SntpService /y
- net stop sophossps /y
- net stop SQLAgent$BKUPEXEC /y
- net stop SQLAgent$ECWDB2 /y
- net stop SQLAgent$PRACTTICEBGC /y
- net stop SQLAgent$PRACTTICEMGT /y
- net stop SQLAgent$PROFXENGAGEMENT /y
- net stop SQLAgent$SBSMONITORING /y
- net stop SQLAgent$SHAREPOINT /y
- net stop SQLAgent$SQL_2008 /y
- net stop SQLAgent$SYSTEM_BGC /y
- net stop SQLAgent$TPS /y
- net stop SQLAgent$TPSAMA /y
- net stop SQLAgent$VEEAMSQL2008R2 /y
- net stop SQLAgent$VEEAMSQL2012 /y
- net stop SQLBrowser /y
- net stop SQLSafeOLRService /y
- net stop SQLSERVERAGENT /y
- net stop SQLTELEMETRY /y
- net stop SQLTELEMETRY$ECWDB2 /y
- net stop SQLWriter /y
- net stop SstpSvc /y
- net stop svcGenericHost /y
- net stop swi_filter /y
- net stop swi_service /y
- net stop swi_update_64 /y
- net stop TmCCSF /y
- net stop tmlisten /y
- net stop TrueKey /y
- net stop TrueKeyScheduler /y
- net stop TrueKeyServiceHelper /y
- net stop UI0Detect /y
- net stop VeeamBackupSvc /y
- net stop VeeamBrokerSvc /y
- net stop VeeamCatalogSvc /y
- net stop VeeamCloudSvc /y
- net stop VeeamDeploymentService /y
- net stop VeeamDeploySvc /y
- net stop VeeamEnterpriseManagerSvc /y
- net stop VeeamMountSvc /y
- net stop VeeamNFSSvc /y
- net stop VeeamRESTSvc /y
- net stop VeeamTransportSvc /y
- net stop W3Svc /y
- net stop wbengine /y
- net stop WRSVC /y
- net stop MSSQL$VEEAMSQL2008R2 /y
- net stop SQLAgent$VEEAMSQL2008R2 /y
- net stop VeeamHvIntegrationSvc /y
- net stop swi_update /y
- net stop SQLAgent$CXDB /y
- net stop SQLAgent$CITRIX_METAFRAME /y
- net stop "SQL Backups" /y
- net stop MSSQL$PROD /y
- net stop "Zoolz 2 Service" /y
- net stop MSSQLServerADHelper /y
- net stop SQLAgent$PROD /y
- net stop msftesql$PROD /y
- net stop NetMsmqActivator /y
- net stop EhttpSrv /y
- net stop ekrn /y
- net stop ESHASRV /y
- net stop MSSQL$SOPHOS /y
- net stop SQLAgent$SOPHOS /y
- net stop AVP /y
- net stop klnagent /y
- net stop MSSQL$SQLEXPRESS /y
- net stop SQLAgent$SQLEXPRESS /y
- net stop wbengine /y
- net stop kavfsslp /y
- net stop KAVFSGT /y
- net stop KAVFS /y
- net stop mfefire /y
- Injects to all running processes except for the following:
- csrss.exe
- explorer.exe
- lsaas.exe
Ransomware Routine
This Ransomware appends the following extension to the file name of the encrypted files:
- .RYK
It drops the following file(s) as ransom note:
- {Encrypted Directory}\RyukReadMe.html
SOLUTION
Step 1
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 2
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 3
Restart in Safe Mode
Step 4
Search and delete these files
- %System Root%\users\Public\sys
- %System Root%\users\Public\PUBLIC
- %System Root%\users\Public\UNIQUE_ID_DO_NOT_REMOVE
- %System Root%\users\Public\window.bat <-Uses to delete shadow copies and backup.
- {Encrypted Directory}\RyukReadMe.html
Step 5
Restart in normal mode and scan your computer with your Trend Micro product for files detected as Ransom.Win64.RYUK.SM. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 6
Restore encrypted files from backup.
Did this description help? Tell us how we did.