Ransom.Win32.OOGLEGO.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following folders:

• {Encrypted Drive Letter}:\temp

It drops the following files:

• {Encrypted Drive Letter}:\temp\{Random Numbers}.xyzx

It adds the following processes:

• powershell.exe -NoExit -Command -
• "%Windows%\system32\net.exe" view
• "%Windows%\system32\net.exe" view {Computer Name}
• "%System%\Wbem\WMIC.exe" SHADOWCOPY DELETE
• "%Windows%\system32\vssadmin.exe" Delete Shadows /All /Quiet
• "%Windows%\system32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /f /v Debugger /t REG_SZ /d %windir%\system32\cmd.exe
• "%Windows%\system32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f /v Debugger /t REG_SZ /d "Hotkey Disabled"
• "%Windows%\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= recoveryenabled No -inputFormat xml -outputFormat text
• "%Windows%\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= bootstatuspolicy ignoreallfailures -inputFormat xml -outputFormat text
• Clear-RecycleBin -force -ErrorAction:Ignore

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Ransomware adds the following registry entries:

HKLM\SOFTWARE\Micorosoft\
Windows NT\CurrentVersion\Image File Execution Options\
utilman.exe
Debugger = %System%\cmd.exe

HKLM\SOFTWARE\Micorosoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskmgr.exe
Debugger = Hotkey Disabled

Other Details

This Ransomware does the following:

• It Stop Services with the following strings in its name using the command: "%System%\Wbem\WMIC.exe" path Win32_Service where "name like '%%{String_svc}%%'" call stopservice - where String_svc are the following:
  • MSSQL
  • SQLAgent
  • SQLBrowser
  • ReportServer
  • SQLWriter
  • SQL
  • MySQL
  • firebird
  • WinDefend
  • mr2kserv
  • IISADMIN
  • Database
  • QuickBooksDB
  • MongoDB
  • MBAMService
  • Exchange
  • wsbexchange
  • QB
  • Quick
• It terminates processes with the following strings in its name using the command: "%System%\Wbem\WMIC.exe" path Win32_Process where "name like '%%String%%'" call terminate - where String are the following:
  • QB
  • msftefd
  • msftesql
  • mysql
  • node
  • noderunner
  • omtsreco
  • oracle
  • sql
  • store
  • acess
  • acrord
  • code
  • devenv
  • avp
  • swprv
  • VSSVC
  • sqlsrvr
• It encrypts files found in Shared Resources

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• dropbox.exe
• megasync.exe
• onedrive.exe
• googledrivesync.exe
• {Malware Filename}
• FileRecovery.txt
• err.log
• debug.log

It avoids encrypting files found in the following folders:

• {Drive}:\Windows\

It appends the following extension to the file name of the encrypted files:

• _ID_{HDDVolumeID}_H_{BLOCKED}ta.company@{BLOCKED}.google

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\FileRecovery.txt
  

It avoids encrypting files with the following file extensions:

• .sys
• .tmp