Ransom.Win64.JKWERLO.LNS.go

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• powershell “vssadmin delete shadows /all /quiet”
• powershell “netsh advfirewall set allprofiles state off”
• %Program Files%\Windows Defender\MpCmdRun.exe -RemoveDefinitions -All
• powershell “reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem /v LongPathsEnabled /t REG_DWORD /d 1 /f”
• powershell “reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f”
• powershell “bcdedit /set recoveryenabled No”
• powershell "Get-NetNeighbor | Select-Object IPAddress"
• powershell “del -Path %Downloads%\doc -Recurse -Force”
• powershell “Get-ChildItem -Path ‘%Downloads%’ -Filter *.lnk | Remove-Item -Force”
• powershell “Get-ChildItem -Path ‘%Downloads%’ -Filter *.zip | Remove-Item -Force”
• powershell “Get-ChildItem -Path ‘%Downloads%’ -Filter *.html | Remove-Item -Force”

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)

Prozessbeendigung

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• via taskkill /F /IM:
  • sql.exe
  • oracle.exe
  • excel.exe
  • infopath.exe
  • msaccess.exe
  • onenote.exe
  • outlook.exe
  • powerpnt.exe
  • thunderbird.exe
  • tbirdconfig.exe
  • visio.exe
  • winword.exe
  • wordpad.exe
  • notepad.exe

Andere Details

Es macht Folgendes:

• It gathers information about network neighbors on the local computer.
• It disables the automatic recovery feature in Windows by modifying the Boot Configuration Data (BCD).
• It disables the Windows Firewall for all network profiles.
• It then deletes its dropped files from the system.