Ransom.Win32.AGENDA.YXDGDT

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• cmd /C fsutil behavior set SymlinkEvaluation R2R:1 ← Enable remote to remote symbolic link
• cmd /C fsutil behavior set SymlinkEvaluation R2L:1 ← Enable remote to local symbolic link
• powershell -Command "\"{get-service LanmanWorkstation |Restart-Service -Force}\""
• cmd /C net use
• cmd /C sc config vss start=demand
• cmd /C net start vss
• cmd /C vssadmin.exe delete shadows /all /quiet ← Deletes shadow copies
• cmd /C sc config vss start=disabled
• cmd /C net stop vss
• cmd /C for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"

Otras modificaciones del sistema

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkConnections = 1

HKEY_LOCAL_MACHINESYSTEM\CurrentControlSet\Services\
LanmanServer\Parameters
MaxMpxCt = 65535

Finalización del proceso

Finaliza los servicios siguientes si los detecta en el sistema afectado:

• (.*?)sql(.*?)
• acronisagent
• acrsch2svc
• anagementservice
• backup
• backupexecagentaccelerator
• backupexecagentbrowser
• backupexecdivecimediaservice
• backupexecjobengine
• backupexecm
• backupexecrpcservice
• backupexecvssprovider
• ervice
• gxblr
• gxcimgr
• gxclmgrs
• gxcvd
• gxfwd
• gxmmm
• gxvss
• gxvsshwprov
• memtas
• mepocs
• msexchange
• msexchange\$
• mvarmor
• mvarmor64
• pdvfsservice
• qbcfmonitorservice
• qbdbmgrn
• qbidpservice
• sap
• sap\$
• sapd\$
• saphostcontrol
• saphostexec
• sapservice
• sophos
• veeam
• veeamdeployments
• veeamnfssvc
• veeamtransportsvc
• vmms
• vsnap
• vss
• wsbexchange

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• agntsvc
• avagent
• avscc
• bedbh
• ben
• benetns
• beserver
• cagservice
• cess
• cvd
• cvfwd
• cvmountd
• cvods
• dbeng50
• dbsnmp
• dellsystemde
• encsvc
• enterpriseclient
• excel
• firefox
• gien
• infopath
• isqlplussvc
• msac
• msaccess
• mspub
• mvdesktopservice
• mydesktopqos
• mydesktopservice
• notepad
• ocautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• powerpnt
• pvlsvr
• qbcfmonitorservice
• qbdbmgrn
• qbidpservice
• raw_agent_svc
• sap
• saphostexec
• saposcol
• sapstartsrv
• sqbcoreservice
• sql
• steam
• synctime
• tbirdconfig
• teamviewer
• teamviewer_service
• tect
• thebat
• thunderbird
• tv_w32
• tv_x64
• veeamdeploymentsvc
• veeamnfssvc
• veeamtransportsvc
• visio
• vmms
• vmwp
• vsnapvss
• vxmon
• winword
• wordpad
• xfssvccon

Otros detalles

Hace lo siguiente:

• It enables privileges in its own access token.
• When the parameter, '-propagate' is used; it performs the following actions:
  • It adds the following folder:
    • %System Root%\{Random Characters}
  • It drops the following files:
    • %System Root%\{Random Characters}\PsExec.exe ← Legitimate Windows Application to execute the Agenda binary on remote machines within the network.
  • It adds the following processes:
    • cmd /C PowerShell.exe (Get-ADComputer -filter *).name ← Enumerate domain computers

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).