Ransom.Win32.AGENDA.RY

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following folders:

• %Temp%\QLOG

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

It drops the following files:

• %Temp%\QLOG\ThreadId(Number).LOG

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

It adds the following processes:

• """{Malware file path}"" --password {String} --escalated --parent-sid ""S-1-5-21-2019512041-42308"
• "cmd" /C fsutil behavior set SymlinkEvaluation R2R:1
• "cmd" /C fsutil behavior set SymlinkEvaluation R2L:1
• "cmd" /C net use
• "cmd" /C wmic service where name='vss' call ChangeStartMode Manual
• "cmd" /C net start vss
• "cmd" /C vssadmin.exe delete shadows /all /quiet
• "cmd" /C net stop vss
• "cmd" /C wmic service where name='vss' call ChangeStartMode Disabled
• "powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)}

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkedConnections = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\LanmanServer\Parameters
MaxMpxCt = 65535

Process Termination

This Ransomware terminates the following services if found on the affected system:

• (.*?)sql(.*?).
• acronisagent
• acrsch2svc
• backup
• backupexecagentaccelerator
• backupexecagentbrowser
• backupexecdivecimediaservice
• backupexecjobengine
• backupexecmanagementservice
• backupexecrpcservice
• backupexecvssprovider
• gxblr
• gxcimgr
• gxclmgrs
• gxcvd
• gxfwd
• gxmmm
• gxvss
• gxvsshwprov
• memtas
• mepocs
• msexchange
• msexchange
• msexchange\$
• mvarmor
• mvarmor64
• pdvfsservice
• qbcfmonitorservice
• qbdbmgrn
• qbidpservice
• sap
• sap\$
• sapd\$
• saphostcontrol
• saphostexec
• sapservice
• sophos
• sql
• veeam
• veeamdeploymentservice
• veeamnfssvc
• veeamtransportsvc
• vmms
• vsnapvss
• vss
• wsbexchange

It terminates the following processes if found running in the affected system's memory:

• agntsvc
• avagent
• avscc
• bedbh
• benetns
• bengien
• beserver
• cagservice
• cvd
• cvfwd
• cvmountd
• cvods
• dbeng50
• dbsnmp
• dellsystemdetect
• encsvc
• enterpriseclient
• excel
• firefox
• infopath
• isqlplussvc
• msaccess
• mspub
• mvdesktopservice
• mydesktopqos
• mydesktopservice
• notepad
• ocautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• powerpnt
• pvlsvr
• qbcfmonitorservice
• qbdbmgrn
• qbidpservice
• raw_agent_svc
• sap
• saphostexec
• saposcol
• sapstartsrv
• sqbcoreservice
• sql
• steam
• synctime
• tbirdconfig
• teamviewer
• teamviewer_service
• thebat
• thunderbird
• tv_w32
• tv_x64
• veeamdeploymentsvc
• veeamnfssvc
• veeamtransportsvc
• visio
• vmcompute
• vmms
• vmwp
• vsnapvss
• vxmon
• winword
• wordpad
• xfssvccon

Other Details

This Ransomware does the following:

• It terminates itself if it detects that the sample is being executed within a virtual environment.
• It requires the correct input password to proceed in its intended routine.
• Checks for the presence of the following processes:
  • wininit.exe
  • winlogon.exe
  • lsass.exe

It accepts the following parameters:

• --password {String} → Password to enter landing.
• --paths {Directory} → Defines the path that parses directories; if this flag is used and left empty, all directories will be scanned.
• --ips {IP Addresses} → Allows for providiing IP addresses.
• --exclude {Directory} → Excluded directories for encryption.
• --timer → Sets a time delay before execution.
• --safe → Restart in safe mode.
• --escalated → Execute the sample with admin privelege.
• --parent-sid → Sets the Security Identifier
• --no-domain → Disable encyption of domain area.
• --no-network → Disable ecnryption of network area.
• --no-ef → Disable extension filter.
• --no-ff → Disable file filter.
• --no-df → Disable directory filter.
• --no-proc → Processes will not be terminated protocol driver not attached.
• --no-service → Services will not be stopped.
• --debugspread
• --kill-cluster
• --impersonate
• --force
• --print-image
• --print-delay
• --spreads
• --spread-vcenter
• --spread-process
• --no-local
• --no-extension
• --no-wallpaper
• --no-delete
• --no-destruct
• --no-zero
• --no-escalate

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• #recycle
• #recycle
• autorun.inf
• autorun.inf
• autorun.ini
• boot.ini
• boot.ini
• bootfont.bin
• bootfont.bin
• bootmgfw.efi
• bootmgfw.efi
• bootmgr
• bootmgr
• bootmgr.efi
• bootmgr.efi
• bootsect.bak
• bootsect.bak
• desktop.ini
• desktop.ini
• iconcache.db
• iconcache.db
• ntldr
• ntldr
• ntuser.dat
• ntuser.dat
• ntuser.dat.log
• ntuser.dat.log
• ntuser.ini
• ntuser.ini
• thumbs.db
• thumbs.db

It avoids encrypting files with the following strings in their file path:

• $recycle.bin
• $windows.~bt
• $windows.~ws
• admin$
• admin$
• appdata
• appdata
• application data
• boot
• boot
• config.msi
• google
• intel
• ipc$
• mozilla
• msocache
• netlogon
• perflogs
• programdata
• system volume information
• sysvol
• tor browser
• windows
• windows
• windows.old
• windows.old

It appends the following extension to the file name of the encrypted files:

• {Original filename}.{Original Extension}.VayvEy6cPo.1

It drops the following file(s) as ransom note:

• {All Available Directories}\README-RECOVER-VayvEy6cPo.txt
  
  

It avoids encrypting files with the following file extensions:

• 386
• adv
• ani
• bat
• bin
• cmd
• com
• cpl
• cur
• deskthemepack
• diagcab
• diagcfg
• diapkg
• dll
• drv
• exe
• hlp
• hta
• icl
• icns
• ico
• ics
• idx
• key
• lnk
• lock
• mod
• mpa
• msc
• msi
• msp
• msstyles
• msu
• nls
• nomedia
• ocx
• pdb
• prf
• ps1
• rom
• rtp
• scr
• shs
• spl
• sys
• theme
• themepack
• VayvEy6cPo
• wpx