Ransom.Win64.RHYSIDA.THEBBBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %Public%\bg.jpg

Fügt die folgenden Prozesse hinzu:

• cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
• cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
• cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%Public%\bg.jpg" /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "%Public%\bg.jpg" /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
• cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
• rundll32.exe user32.dll,UpdatePerUserSystemParameters
• cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "{Malware File Path}\{Malware File Name}" -ErrorAction SilentlyContinue; → executed to delete itself after execution

Andere Systemänderungen

Ändert das Hintergrundbild des Desktops durch Abänderung der folgenden Registrierungseinträge:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

Stellt auf dem System das folgende Bild als Desktop-Hintergrundbild ein:

• %Public%\bg.jpg
  

Andere Details

Es macht Folgendes:

• It displays its activity on the console.
• It initializes resources based on the number of processors available in the system.
• It encrypts all system drives from A to Z.
• It deletes itself after execution.
• It displays the following after execution: