Ransom.MSIL.TENCRYPT.THDADBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• vssadmin delete shadows /all /quiet & wmic shadowcopy delete
• bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
• wbadmin delete catalog -quiet

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Computer Name}

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

• %User Temp%\{random}.jpg
  

Process Termination

This Ransomware terminates the following services if found on the affected system:

• BackupExecAgentBrowser
• veeam
• VeeamDeploymentSvc
• PDVFSService
• BackupExecVSSProvider
• BackupExecAgentAccelerator
• vss
• sql
• svc$
• AcrSch2Svc
• AcronisAgent
• Veeam.EndPoint.Service
• CASAD2DWebSvc
• CAARCUpdateSvc
• YooIT
• memtas
• sophos
• veeam
• DefWatch
• ccEvtMgr
• SavRoam
• RTVscan
• QBFCService
• Intuit.QuickBooks.FCS
• YooBackup
• BackupExecAgentBrowser
• BackupExecRPCService
• MSSQLSERVER
• backup
• GxVss
• GxBlr
• GxFWD
• GxCVD
• GxCIMgr
• VeeamNFSSvc
• BackupExecDiveciMediaService
• SQLBrowser
• SQLAgent$VEEAMSQL2008R2
• SQLAgent$VEEAMSQL2012
• VeeamDeploymentService
• BackupExecJobEngine
• Veeam.EndPoint.Tray
• BackupExecManagementService
• SQLAgent$SQL_2008
• BackupExecRPCService
• zhudongfangyu
• sophos
• stc_raw_agent
• VSNAPVSS
• QBCFMonitorService
• VeeamTransportSvc

It terminates the following processes if found running in the affected system's memory:

• sqlwriter
• sqbcoreservice
• VirtualBoxVM
• sqlagent
• sqlbrowser
• sqlservr
• code
• steam
• zoolz
• agntsvc
• firefoxconfig
• infopath
• synctime
• VBoxSVC
• tbirdconfig
• thebat
• thebat64
• isqlplussvc
• mydesktopservice
• mysqld
• ocssd
• onenote
• mspub
• mydesktopqos
• CNTAoSMgr
• Ntrtscan
• vmplayer
• oracle
• outlook
• powerpnt
• wps
• xfssvccon
• ProcessHacker
• dbeng50
• dbsnmp
• encsvc
• excel
• tmlisten
• PccNTMon
• mysqld-nt
• mysqld-opt
• ocautoupds
• ocomm
• msaccess
• msftesql
• thunderbird
• visio
• winword
• wordpad
• mbamtray

Other Details

This Ransomware does the following:

• It attempts to change the read-only folders and files to normal so that it can access them.
• It avoids encrypting files in folders with the hidden attribute.
• It checks the size of the file to encrypt
  • If the file has less than 524,288 bytes (512 KB or 0.5 MB)
  • It encrypts the whole file
  • If the file has more than 524,288 bytes (512 KB or 0.5 MB)
  • It encrypts the first 20,000 bytes
  • It encrypts 20,000 bytes from middle of the file
  • It encrypts the last 20,000 bytes

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .myd
• .ndf
• .qry
• .sdb
• .sdf
• .tmd
• .tgz
• .lzo
• .txt
• .jar
• .dat
• .contact
• .settings
• .doc
• .docx
• .xls
• .xlsx
• .ppt
• .pptx
• .odt
• .jpg
• .mka
• .mhtml
• .oqy
• .png
• .csv
• .py
• .sql
• .indd
• .cs
• .mp3
• .mp4
• .dwg
• .zip
• .rar
• .mov
• .rtf
• .bmp
• .mkv
• .avi
• .apk
• .lnk
• .dib
• .dic
• .dif
• .mdb
• .php
• .asp
• .aspx
• .html
• .htm
• .xml
• .psd
• .pdf
• .xla
• .cub
• .dae
• .divx
• .iso
• .7zip
• .pdb
• .ico
• .pas
• .db
• .wmv
• .swf
• .cer
• .bak
• .backup
• .accdb
• .bay
• .p7c
• .exif
• .vss
• .raw
• .m4a
• .wma
• .ace
• .arj
• .bz2
• .cab
• .gzip
• .lzh
• .tar
• .jpeg
• .xz
• .mpeg
• .torrent
• .mpg
• .core
• .flv
• .sie
• .sum
• .ibank
• .wallet
• .css
• .js
• .rb
• .crt
• .xlsm
• .xlsb
• .7z
• .cpp
• .java
• .jpe
• .ini
• .blob
• .wps
• .docm
• .wav
• .3gp
• .gif
• .log
• .gz
• .config
• .vb
• .m1v
• .sln
• .pst
• .obj
• .xlam
• .djvu
• .inc
• .cvs
• .dbf
• .tbi
• .wpd
• .dot
• .dotx
• .webm
• .m4v
• .amv
• .m4p
• .svg
• .ods
• .bk
• .vdi
• .vmdk
• .onepkg
• .accde
• .jsp
• .json
• .xltx
• .vsdx
• .uxdc
• .udl
• .3ds
• .3fr
• .3g2
• .accda
• .accdc
• .accdw
• .adp
• .ai
• .ai3
• .ai4
• .ai5
• .ai6
• .ai7
• .ai8
• .arw
• .ascx
• .asm
• .asmx
• .avs
• .bin
• .cfm
• .dbx
• .dcm
• .dcr
• .pict
• .rgbe
• .dwt
• .f4v
• .exr
• .kwm
• .max
• .mda
• .mde
• .mdf
• .mdw
• .mht
• .mpv
• .msg
• .myi
• .nef
• .odc
• .geo
• .swift
• .odm
• .odp
• .oft
• .orf
• .pfx
• .p12
• .pl
• .pls
• .safe
• .tab
• .vbs
• .xlk
• .xlm
• .xlt
• .xltm
• .svgz
• .slk
• .tar.gz
• .dmg
• .ps
• .psb
• .tif
• .rss
• .key
• .vob
• .epsp
• .dc3
• .iff
• .opt
• .onetoc2
• .nrw
• .pptm
• .potx
• .potm
• .pot
• .xlw
• .xps
• .xsd
• .xsf
• .xsl
• .kmz
• .accdr
• .stm
• .accdt
• .ppam
• .pps
• .ppsm
• .1cd
• .p7b
• .wdb
• .sqlite
• .sqlite3
• .db-shm
• .db-wal
• .dacpac
• .zipx
• .lzma
• .z
• .tar.xz
• .pam
• .r3d
• .ova
• .1c
• .dt
• .c
• .vmx
• .xhtml
• .ckp
• .db3
• .dbc
• .dbs
• .dbt
• .dbv
• .frm
• .mwb
• .mrg
• .txz
• .mrg
• .vbox
• .wmf
• .wim
• .xtp2
• .xsn
• .xslt

It avoids encrypting files with the following strings in their file name:

• iconcache.db
• autorun.inf
• thumbs.db
• boot.ini
• bootfont.bin
• ntuser.ini
• bootmgr
• bootmgr.efi
• bootmgfw.efi
• desktop.ini
• ntuser.dat
• RESTORE-FILES-{random}.txt

It avoids encrypting files found in the following folders:

• %System Root%\windows.old
• %System Root%\windows.old.old
• %System Root%\amd
• %System Root%\nvidia
• %System Root%\program files
• %System Root%\program files (x86)
• %System Root%\windows
• %System Root%\$recycle.bin
• %System Root%\documents and settings
• %System Root%\intel
• %System Root%\perflogs
• %System Root%\programdata
• %System Root%\boot
• %System Root%\games
• %System Root%\msocache

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .{5 random characters}

It drops the following file(s) as ransom note:

• {encrypted path}\RESTORE-FILES-{random}.txt