Ransom.Win32.PARADISE.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %Windows%\sysnative\vssadmin.exe delete shadows /all /quiet
• cmd.exe "ping 127.0.0.1 && del {Malware Name}.exe
• C:\Windows\System32\mshta.exe %User Startup%\{random characters}.hta
  

Process Termination

This Ransomware terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• mysql
• IBM
• bes10
• black
• sql
• store.exe
• vee
• postg
• sage
• ShadowProtectSvc
• SPAdminV4
• SPTimerV4
• SPTraceV4
• SPUserCodeV4
• SPWriterV4
• SPSearch4
• firebirdguardiandefaultinstance
• Simply Accounting Database Connection Manager
• ibmiasrw
• QBPOSDBServiceV12
• QBCFMonitorService
• QBVSS
• mr2kserv
• WinDefend
• MSExchangeADTopology
• SQLWriter
• ReportServer$ISARS
• SQLBrowser
• IISADMIN
• IBM Domino Server (CProgramFilesIBMDominodata)
• MSExchangeSA
• MSExchangeIS
• IBM Domino Diagnostics (CProgramFilesIBMDomino)
• QuickBooksDB25
• QuickBooksDB24
• QuickBooksDB23
• QuickBooksDB22
• QuickBooksDB21
• QuickBooksDB20
• QuickBooksDB19
• QuickBooksDB18
• QuickBooksDB17
• QuickBooksDB16
• QuickBooksDB15
• QuickBooksDB14
• QuickBooksDB13
• QuickBooksDB12
• QuickBooksDB11
• QuickBooksDB10
• QuickBooksDB9
• QuickBooksDB8
• QuickBooksDB7
• QuickBooksDB6
• QuickBooksDB5
• QuickBooksDB4
• QuickBooksDB3
• QuickBooksDB2
• QuickBooksDB1
• MSExchangeFBA
• SQLAgent$MSFW
• SQLAgent$ISARS
• MSSQL$MSFW
• MSSQL$ISARS
• MSSQLServerADHelper100

Dropping Routine

This Ransomware drops the following files:

• %Application Data%\parid.bin - contains unique code
• %User Startup%\{random characters}.hta
• %User Startup%\{random characters}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other Details

This Ransomware connects to the following possibly malicious URL:

• {BLOCKED}er.org/{random characters}

It does the following:

• Checks the language of the target computer
  • if Russian, Kazakhstan, belarusian, Ukrainian, and tatar, execute "cmd.exe "ping 127.0.0.1 && del ""{Malware Name}.exe"""
  • if it failed, do non compatible language behavior
  • if successful, terminate itself
  • else continue encryption

However, as of this writing, the said sites are inaccessible.

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• Windows
• $Recycle Bin
• System Volume Information
• Program Files
• Program Files(x86)

It renames encrypted files using the following names:

• {encrypted file}{unique code}{{BLOCKED}t@p-security.li}.exploit

It drops the following file(s) as ransom note:

• {all folders encrypted}\Instructions with your files.txt