Ransom.Win32.OOGLEGO.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las carpetas siguientes:

• {Encrypted Drive Letter}:\temp

Infiltra los archivos siguientes:

• {Encrypted Drive Letter}:\temp\{Random Numbers}.xyzx

Agrega los procesos siguientes:

• powershell.exe -NoExit -Command -
• "%Windows%\system32\net.exe" view
• "%Windows%\system32\net.exe" view {Computer Name}
• "%System%\Wbem\WMIC.exe" SHADOWCOPY DELETE
• "%Windows%\system32\vssadmin.exe" Delete Shadows /All /Quiet
• "%Windows%\system32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /f /v Debugger /t REG_SZ /d %windir%\system32\cmd.exe
• "%Windows%\system32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f /v Debugger /t REG_SZ /d "Hotkey Disabled"
• "%Windows%\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= recoveryenabled No -inputFormat xml -outputFormat text
• "%Windows%\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= bootstatuspolicy ignoreallfailures -inputFormat xml -outputFormat text
• Clear-RecycleBin -force -ErrorAction:Ignore

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKLM\SOFTWARE\Micorosoft\
Windows NT\CurrentVersion\Image File Execution Options\
utilman.exe
Debugger = %System%\cmd.exe

HKLM\SOFTWARE\Micorosoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskmgr.exe
Debugger = Hotkey Disabled

Otros detalles

Hace lo siguiente:

• It Stop Services with the following strings in its name using the command: "%System%\Wbem\WMIC.exe" path Win32_Service where "name like '%%{String_svc}%%'" call stopservice - where String_svc are the following:
  • MSSQL
  • SQLAgent
  • SQLBrowser
  • ReportServer
  • SQLWriter
  • SQL
  • MySQL
  • firebird
  • WinDefend
  • mr2kserv
  • IISADMIN
  • Database
  • QuickBooksDB
  • MongoDB
  • MBAMService
  • Exchange
  • wsbexchange
  • QB
  • Quick
• It terminates processes with the following strings in its name using the command: "%System%\Wbem\WMIC.exe" path Win32_Process where "name like '%%String%%'" call terminate - where String are the following:
  • QB
  • msftefd
  • msftesql
  • mysql
  • node
  • noderunner
  • omtsreco
  • oracle
  • sql
  • store
  • acess
  • acrord
  • code
  • devenv
  • avp
  • swprv
  • VSSVC
  • sqlsrvr
• It encrypts files found in Shared Resources

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).