Ransom.Win32.MIMIC.SMZTJJ-A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes registry entries, causing some applications and programs to not function properly.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {All affected directories}\Decrypt_me.txt
• %User Temp%\session.tmp
• %AppDataLocal%\{GUID}\bestplacetolive.exe
• %AppDataLocal%\{GUID}\session.tmp
• %User Temp%\{random letters}.{random letters}.ps1
• %User Temp%\{random letters}.{random letters}.psm1
• %AppDataLocal%\{GUID}\Everything32.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%AppDataLocal%\{GUID}\bestplacetolive.exe"
• "%AppDataLocal%\{GUID}\bestplacetolive.exe" -e watch -pid {PID of bestplacetolive.exe} -!
• "%AppDataLocal%\{GUID}\bestplacetolive.exe" -e ul1
• "%AppDataLocal%\{GUID}\bestplacetolive.exe" -e ul2
• powercfg.exe -H off
• powercfg.exe -SETACVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 1} 0
• powercfg.exe -SETACVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 2} 0
• powercfg.exe -SETACVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 3} 0
• powercfg.exe -SETDCVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 1} 0
• powercfg.exe -SETDCVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 2} 0
• powercfg.exe -SETDCVALUEINDEX {Power scheme GUID} {GUID Subgroup} {GUID Setting 3} 0
• powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 1} 0
• powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 2} 0
• powercfg.exe -SETACVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 3} 0
• powercfg.exe -SETDCVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 1} 0
• powercfg.exe -SETDCVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 2} 0
• powercfg.exe -SETDCVALUEINDEX {Power scheme GUID 2} {GUID Subgroup} {GUID Setting 3} 0
• powercfg.exe -S {Power scheme GUID}
• powercfg.exe -S {Power scheme GUID 2}
• powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
• powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
• powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
• cmd.exe /c DC.exe /D

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %AppDataLocal%\{GUID}
• %System Root%\temp

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• iitiitLavvoiteaieii

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
bestplacetolive = "%AppDataLocal%\{GUID}\bestplacetolive.exe"

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\VSS
Start = 4

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\SDRSVC
Start = 4

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\wbengine
Start = 4

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
shutdownwithoutlogon = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\FileSystem
LongPathsEnabled = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
DataCollection
AllowTelemetry = 0

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = 0

(Note: The default value data of the said registry entry is 5.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorUser = 0

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
PromptOnSecureDesktop = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap
UNCAsIntranet = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap
AutoDetect = 1

(Note: The default value data of the said registry entry is 0.)

It deletes the following registry entries:

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows
System = DisableCMD

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows
System = DisableCMD

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
ZoneMap = ProxyBypass

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
ZoneMap = ProxyBypass

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
ZoneMap = IntranetName

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
ZoneMap = IntranetName

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• agntsvc.exe
• autodeskDesktopApp.exe
• axlbridge.exe
• bedbh.exe
• benetns.exe
• bengien.exe
• beserver.exe
• CoreSync.exe
• Creative Cloud.exe
• dbeng50.exe
• dbsnmp.exe
• encsvc.exe
• EnterpriseClient.exe
• fbguard.exe
• fbserver.exe
• fdhost.exe
• fdlauncher.exe
• httpd.exe
• isqlplussvc.exe
• java.exe
• msaccess.exe
• MsDtSrvr.exe
• msftesql.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld-nt.exe
• mysqld-opt.exe
• mysqld.exe
• node.exe
• ocautopds.exe
• ocomm.exe
• ocssd.exe
• oracle.exe
• pvlsvr.exe
• python.exe
• QBDBMgr.exe
• QBDBMgrN.exe
• QBIDPService.exe
• qbupdate.exe
• QBW32.exe
• QBW64.exe
• Raccine.exe
• Raccine_x86.exe
• RaccineElevatedCfg.exe
• RaccineSettings.exe
• RAgui.exe
• raw_agent_svc.exe
• SimplyConnectionManager.exe
• sqbcoreservice.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlmangr.exe
• Sqlservr.exe
• sqlwriter.exe
• Ssms.exe
• Sysmon.exe
• Sysmon64.exe
• tbirdconfig.exe
• tomcat6.exe
• VeeamDeploymentSvc.exe
• vsnapvss.exe
• vxmon.exe
• wdswfsafe.exe
• wpython.exe
• wsa_service.exe
• wxServer.exe
• wxServerView.exe
• xfssvccon.exe

Other Details

This Ransomware adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
Image File Execution Options = {list of processes to be terminated}

HKEY_LOCAL_MACHINE\SOFTWARE
Classes = mimicfile

HKEY_LOCAL_MACHINE\SOFTWARE
Classes = .QUIETPLACE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HidePowerOptions = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HidePowerOptions = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoClose = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
StartMenuLogOff = 1

It requires the following additional components to properly run:

• Everything32.dll

It does the following:

• Collecting system information
• Creating persistence via the RUN key
• Bypassing User Account Control (UAC)
• Disabling Windows Defender
• Disabling Windows telemetry
• Activating anti-shutdown measures
• Activating anti-kill measures
• Unmounting Virtual Drives
• Terminating processes and services
• Disabling sleep mode and shutdown of the system
• Removing indicators
• Inhibiting System Recovery

It accepts the following parameters:

• -dir → directory for encryption
• -e all → encrypt all (default)
• -e Local → encrypt local files
• -e net → encrypt files on network shares
• -e watch
• -e ul1 → unlock certain memory addresses from another process
• -e ul2 → unlock certain memory addresses from another process
• -prot → protects the ransomware from being killed
• -pid → process identifier (PID) of the previously-running ransomware.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• restore-my-files.txt
• boot.ini
• bootfont.bin
• desktop.ini
• iconcache.db
• io.sys
• ntdetect.com
• ntldr
• ntuser.dat
• ntuser.ini
• thumbs.db
• session.tmp
• decrypt_me.txt
• bestplacetolive.exe

It avoids encrypting files with the following strings in their file path:

• cache
• boot
• chrome
• firefox
• mozilla
• Opera
• intel
• msbuild
• tmp
• temp
• windows
• winnt

It appends the following extension to the file name of the encrypted files:

• .QUIETPLACE

It drops the following file(s) as ransom note:

• Decrypt_me.txt