Ransom.MSIL.REDENERGY.THJAOBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %User Temp%\tmp{random}.tmp.bat → terminate itself and delete sample

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• %System%\cmd.exe /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
• %System%\cmd.exe /C wbadmin delete catalog -quiet
• takeown /f \"%System%\smartscreen.exe\" /a
• icacls \"%System%\smartscreen.exe\" /reset → takes ownership of the application and resets the Access Control Lists
• taskkill /im smartscreen.exe /f → terminates the application
• icacls \"%System%\smartscreen.exe\" /inheritance:r /remove * S - 1 - 5 - 32 - 544 * S - 1 - 5 - 11 * S - 1 - 5 - 32 - 545 * S - 1 - 5 - 18 → removes permission from the specified security identifier to access smartscreen.exe
• %User Temp%\SystemPropertiesProtection.exe

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Beendet sich selbst, wenn die folgenden Prozesse im Speicher des betroffenen Systems gefunden werden:

• csfalconservice
• csfalconcontainer
• processhacker
• netstat
• netmon
• tcpview
• wireshark
• filemon
• regmon
• cain
• eguiproxy
• devenv
• ekrn
• rsenginesvc
• fcdblog
• fcappdb
• fortisettings
• fortiesnac
• fortitray
• fsguistarter
• fshoster32

Datendiebstahl

Folgende Daten werden gesammelt:

• Username
• System Locale
• List of Antivirus Products
• List of MAC Address
• Hostname

Andere Details

Es macht Folgendes:

• It sets the attributes of itself to SYSTEM and HIDDEN.
• It terminates itself if the time zone is the following:
  • RU - Russia
  • KZ - Kazakhstan
  • BY - Belarus
  • AM - Armenia
  • AZ - Azerbaijan
  • KG - Kyrgyzstan
  • MD - Moldova
  • TJ - Tajikistan
  • TM - Turkmenitan
  • UZ - Uzbekistan
• It terminates itself if the language of the affected machine is the following:
  • Ukrainian
  • Belarusian
  • Azerbaijani
  • Armenian
  • Georgian
  • Uzbek
  • Russian
  • Kazakh
• It terminates itself if the following network monitoring tools were found in the system:
  • HTTPDebuggerBrowser.dll
  • FiddlerCore4.dll
  • RestSharp.dll
  • Titanium.Web.Proxy.dll
• It checks for the presence of a debugger
• It checks if the sample is running in a 64-bit environment.
• It deletes the original file after encryption.
• It terminates itself if the following prefix of MAC addresses were found in the system:
  • 000C29 - VMWare Inc.
  • 001C14 - Cisco Systems
  • 005056 - VMWare Inc.
  • 000569 - Intel
  • 080027 - VMWare, Inc
  • 000001 - Xerox Corporation
• It terminates itself if the following GUID is found in the system:
  • 4040CF00-1B3E-486A-B407-FA14C56B6FC0
• It restarts the system after file encryption.
• It terminates itself if the following registry entry was found in the system:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
    {data} = C:\ANYRUN