Ransom.MSIL.THANOS.THABGBA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Wird möglicherweise von anderer Malware eingeschleust.

Erstellt bestimmte Registrierungseinträge, um Sicherheitsanwendungen zu deaktivieren.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Wird möglicherweise von der folgenden Malware eingeschleust:

• Trojan.W97M.THANOS.THABGBA

Installation

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• e660f428-738e-469e-93fc-20803ca8aa37

Autostart-Technik

Schleust die folgenden Dateien in den benutzerspezifischen Autostart-Ordner von Windows ein, um sich selbst bei jedem Systemstart auszuführen.

• %User Startup%\mystartup.lnk

(Hinweis: %User Startup% ist der Ordner 'Autostart' des aktuellen Benutzers, normalerweise C:\Windows\Profile\{Benutzername}\Startmenü\Programme\Autostart unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Startmenü\Programme\Autostart unter Windows NT, C:\Documents and Settings\{Benutzername}\Startmenü\Programme\Autostart unter Windows 2003(32-bit), XP und 2000(32-bit) und C:\Users\{Benutzername}\AppData\Roaming\Microsoft\Windows\Startmenü\Programme\Autostart unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Andere Systemänderungen

Erstellt die folgenden Registrierungseinträge, um Sicherheitsanwendungen zu deaktivieren:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable = 1

Andere Details

Es macht Folgendes:

• It terminates the following processes if found using the following commands:
  • "taskkill.exe" /IM mspub.exe /F
  • "taskkill.exe" /IM onenote.exe /F
  • "taskkill.exe" /IM agntsvc.exe /F
  • "taskkill.exe" /IM PccNTMon.exe /F
  • "taskkill.exe" /IM synctime.exe /F
  • "taskkill.exe" /IM thebat.exe /F
  • "taskkill.exe" /IM excel.exe /F
  • "taskkill.exe" /IM msaccess.exe /F
  • "taskkill.exe" /IM steam.exe /F
  • "taskkill.exe" /IM firefoxconfig.exe /F
  • "taskkill.exe" /IM CNTAoSMgr.exe /F
  • "taskkill.exe" /IM dbeng50.exe /F
  • "taskkill.exe" /IM sqlwriter.exe /F
  • "taskkill.exe" /IM infopath.exe /F
  • "taskkill.exe" /IM mspub.exe /F
  • "taskkill.exe" /IM Ntrtscan.exe /F
  • "taskkill.exe" /IM outlook.exe /F
  • "taskkill.exe" /IM mydesktopservice.exe /F
  • "taskkill.exe" /IM encsvc.exe /F
  • "taskkill.exe" /IM tbirdconfig.exe /F
  • "taskkill.exe" /IM mbamtray.exe /F
  • "taskkill.exe" /IM mydesktopqos.exe /F
  • "taskkill.exe" /IM thebat64.exe /F
  • "taskkill.exe" /IM zoolz.exe /F
  • "taskkill.exe" /IM tmlisten.exe /F
  • "taskkill.exe" /IM sqlservr.exe /F
  • "taskkill.exe" /IM winword.exe /F
  • "taskkill.exe" /IM visio.exe /F
  • "taskkill.exe" /IM mydesktopqos.exe /F
  • "taskkill.exe" /IM mydesktopservice.exe /F
  • "taskkill.exe" /IM mysqld.exe /F
  • "taskkill.exe" /IM isqlplussvc.exe /F
  • "taskkill.exe" /IM msftesql.exe /F
  • "taskkill.exe" /IM sqbcoreservice.exe /F
  • "taskkill.exe" /IM ocomm.exe /F
  • "taskkill.exe" IM thunderbird.exe /F
  • "taskkill.exe" /IM mysqld-nt.exe /F
  • "taskkill.exe" /IM dbsnmp.exe /F
  • "taskkill.exe" /IM powerpnt.exe /F
  • "taskkill.exe" /IM xfssvccon.exe /F
  • "taskkill.exe" /IM wordpad.exe /F
  • "taskkill.exe" /IM mysqld-opt.exe /F
  • "taskkill.exe" /IM ocautoupds.exe /F
• It terminates all running processes unless the following strings are found in the process name:
  • chrome
  • opera
  • msedge
  • iexplore
  • firefox
  • explorer
  • wininit
  • winlogon
  • SearchApp
  • SearchIndexer
  • SearchUI
• It checks if the following programs are running. If they are, the said programs are terminated, and the main ransomware program will terminate as well:
  • http analyzer stand-alone
  • fiddler
  • effetech http sniffer
  • firesheep
  • IEWatch Professional
  • wireshark portable
  • sysinternals tcpview
  • dumpcap
  • wireshark
  • ollydbg
  • x64dbg
  • x32dbg
  • dnspy
  • dnspy-x86
  • de4dot
  • ilspy
  • dotpeek
  • dotpeek64
  • ida64
  • RDG Packer Detector
  • CFF Explorer
  • PEiD
  • protection_id
  • LordPE
  • pe-sieve
  • MegaDumper
  • UnConfuserEx
  • Universal_Fixer
  • NoFuserEx
  • NetworkMiner
  • NetworkTrafficView
  • HTTPNetworkSniffer
  • tcpdump
  • intercepter
  • intercepter-NG
• It deletes the following registry subkeys to delete shadow copies:
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • vssadmin.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • wmic.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • wbadmin.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • bcdedit.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • powershell.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • diskshadow.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • net.exe
        
• The malware disables the following using powershell console:
  • "DisableRealtimeMonitoring"
  • "DisableBehaviorMonitoring"
  • "DisableBlockAtFirstSeen"
  • "DisableIOAVProtection"
  • "DisablePrivacyMode"
  • "SignatureDisableUpdateOnStartupWithoutEngine"
  • "DisableArchiveScanning"
  • "DisableIntrusionPreventionSystem"
  • "DisableScriptScanning"
  • "SubmitSamplesConsent"
  • "MAPSReporting"
  • "HighThreatDefaultAction"
  • "ModerateThreatDefaultAction"
  • "LowThreatDefaultAction"
  • "SevereThreatDefaultAction"