Ransom.Win32.MATRIX.AD

This Ransomware connects to certain websites to send and receive information.

Installation

This Ransomware drops the following copies of itself into the affected system and executes them:

• {Malware Path}\{random characters}.exe

It drops the following files:

• {Malware Path}\ALL_CrDfLDmp.tmp
• {Malware Path}\log.txt
• %Application Data%\{random characters}.bmp → used as wallpaper
• %Application Data%\{random characters}.bat → contains commands to remove volume shadow copies and disable system recovery
• %Application Data%\{random characters}.vbs → contains commands to create scheduled task
• {Malware Path}\{random characters}.exe → used for file handle manipulation
• {Malware Path}\{random characters}.bat → contains commands to take ownership of a file

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

It adds the following processes:

• {Malware Path}\{8 random characters}.exe -n → if run without argument

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• MutexSCR → if run without argument
• MutexSCRDONW → if run with argument

Other System Modifications

This Ransomware deletes the following files:

• %Application Data%\{random characters}.vbs
• %Application Data%\{random characters}.bat

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Application Data%\{random characters}.bmp

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 0

HKEY_CURRENT_USER\Control Panel\Desktop
TileWallpaper = 0

It sets the system's desktop wallpaper to the following image:

Other Details

This Ransomware connects to the following website to send and receive information:

• http://mai-hoand.{BLOCKED}hostapp.com/addrecord.php?apikey={key}&compuser={computer name}|{username}&sid={sid}&phase=START

It encrypts files with the following extensions:

• .mdf
• .ndf
• .ldf
• .myd
• .eql
• .sql
• .vhd
• .sqlite
• .sqlite3
• .sqlitedb
• .hwp
• .hwt
• .hml
• .hwdt
• .hwpx
• .cell
• .nxl
• .hcdt
• .nxts
• .how
• .hpt
• .hsdt
• .xlsx
• .xls
• .docx
• .doc
• .dot
• .dotx
• .odt
• .ods
• .bak
• .tib
• .dbs
• .db
• .dbk
• .db2
• .db3
• .dbc
• .dt
• .dbs
• .dbf
• .dbx
• .mdb
• .sdf
• .ndf
• .ns2
• .ns3
• .ns4
• .nsf
• .accdb
• .vpd
• .dwg
• .cdr
• .pdf
• .jpg
• .jpeg
• .psd
• .zip
• .rar
• .7z
• .tar
• .gz

It does the following:

• It encrypts files located in the following locations:
  • Shared drives
  • Removable drives
  • Fixed drives
  • Ramdisk
• It deletes shadow copies by executing the following commands:
  • vssadmin Delete Shadows /All /Quiet
  • wmic SHADOWCOPY DELETE
• It disables system recovery by executing the following commands:
  • bcdedit /set {default} recoveryenabled No
  • bcdedit /set {default} bootstatuspolicy ignoreallfailures
• It deletes the scheduled task with the following task name:
  
  • DSHCA
• It avoids encrypting files with the following file extensions:
  • .vbs
  • .rtf
  • .bmp
  • .tmp
  • .rdp
  • .sek
  • .ico
  • .dll
  • .blf
  • .rbs
  • .regtrans-ms
  • .settingcontent-ms
  • .search-ms
  • .log
  • .xml
  • .log1
  • .log2
• It avoids encrypting the following files:
  • ntuser.dat
  • ntuser.pol
  • ntuser.dat.log
  • ntuser.dat.log1
  • ntuser.dat.log2
  • iconcache.db
  • thumbs.db
  • bootsect.bak
  • bootmgr
  • default.rdp
  • pagefile.sys
  • hiberfil.sys
  • swapfile.sys
  • wordpad.exe
• It retrieves the following information:
  • Computer name
  • User name
  • System integrity level

It accepts the following parameters:

• -n

It adds the following scheduled tasks:

• Task name: DHSCA
  Schedule: Every 5 minutes
  Task to be run: %Application Data%\{random characters}.bat

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• WINDOWS SIDEBAR
• WINDOWS MEDIA PLAYER
• DVD MAKER
• WINDOWSPOWERSHELL
• WINDOWSDEFENDER
• TORBROWSER
• ASPNET_CLIENT
• REFERENCE ASSEMBLIES
• MICROSOFT\PROVISIONING
• MICROSOFT SILVERLIGHT
• PROGRAMDATA\MICROSOFT
• MICROSOFT\CRYPTO
• WINDOWSAPPS
• 7-ZIP
• WINRAR
• ESET
• AVAST
• MALWAREBYTES
• SYMANTEC ENDPOINT
• TREND MICRO
• BITDEFENDER
• PANDA SECURITY
• MCAFEE
• GAMMA08
• WINDOWS
• WINDOWS.OLD
• WINDOWS10UPGRADE
• $RECYCLE.BIN
• WINDOWS NT
• COMMON FILES
• TEMP
• BOOT
• MSOCACHE
• DEFAULT USER
• FILES\ACRONIS
• (X86)\ACRONIS
• FILES\BACKUPCLIENT
• (X86)\BACKUPCLIENT
• FILES\BACKUPMANAGER
• (X86)\BACKUP MANAGER
• FILES\CARBONITE
• (X86)\CARBONITE
• FILES\GOOGLE\DRIVE
• (X86)\GOOGLE\DRIVE
• FILES\DROPBOX
• (X86)\DROPBOX
• FILES\MICROSOFT ONEDRIVE
• (X86)\MICROSOFT ONEDRIVE
• FILES\ONEDRIVE
• (X86)\ONEDRIVE
• VNC
• INTERNET EXPLORER
• MICROSOFT\OFFICE
• MICROSOFT OFFICE
• KASPERSKY LAB
• KASPERSKYLAB
• AVDEFENDER
• SOPHOS
• AVG

It renames encrypted files using the following names:

• [SecurCyber@yahoo.com].{8 random characters}-{8 random characters}.SCR

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\#SCR_INFO#.rtf