Ransom.Win32.GRIEF.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• vssadmin.exe Delete Shadows /All /Quiet
• bcdedit.exe /set {default} safeboot minimal
• bcdedit.exe /set {default} recoveryenabled No
• %System%\icacls.exe ":\*" /grant:r Everyone:F /t /c /q -> grant access to the drives it encrypts

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Andere Systemänderungen

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeCaption = We made you. P0G-{number}

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeText =

Prozessbeendigung

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• sqlagent
• sophos

Andere Details

Es macht Folgendes:

• It expects itself to be executed as a service
• It installs itself as a service through modifying a service's ImagePath to point to itself and execute it along with its correct argument
• In these particular samples, there is currently no way to terminate processes. The embedded Process Hacker is not included in the ransomware samples, and it does not enumerate running processes
• It removes connections to network shared resources
• It requires a specific argument in order for it to proceed to its malicious routine
• It changes the password of every user to the following:
  • JaR99"Zd!51E4ECAE7509C3130AC4D2AD949E171F
• It initiates a system reboot after its installation