Ransom.Win32.VENUS.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops and executes the following files:

• %Windows%\{Malware Filename}.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

• "%Windows%\{Malware Filename}.exe" g g g o n e123
• /C taskkill /F /IM {Process to terminate} → Terminates hardcoded list of processes
• /C wbadmin delete catalog -quiet && vssadmin.exe delete shadows /all /quiet && bcdedit.exe /set {current} nx alwaysOff && wmic SHaDOWCOPY DELETE → Deletes system event logs and Shadow copies
• "%Windows%\SysWOW64\mshta.exe" "%User Temp%\32931062991972502381.hta"
• /c ping localhost -n 3 > nul & del {Malware Path}\{Malware Filename}.exe → Deletes the original malware file

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It executes then deletes itself afterward.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Random 20 character string}

Autostart Technique

This Ransomware creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Malware Filename} = %Windows%\{Malware Filename}.exe

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
pbsecGOOD = {Random Characters}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
secpbGOOD = {Random Characters}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.venus
Default = %Windows%\{Random 20 character string}.png

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{Random 20 character string}.jpg

It sets the system's desktop wallpaper to the following image:

• %User Temp%\{Random 20 character string}.jpg
  

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• mydesktopqos.exe
• agntsvc.exe
• isqlplussvc.exe
• xfssvccon.exe
• mydesktopservice.exe
• ocautoupds.exe
• agntsvc.exe
• agntsvc.exe
• agntsvc.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• sqlservr.exe
• thebat64.exe
• thunderbird.exe
• winword.exe
• wordpad.exe
• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• mydesktopqos.exe
• agntsvc.exe
• isqlplussvc.exe
• xfssvccon.exe
• mydesktopservice.exe
• ocautoupds.exe
• agntsvc.exe
• agntsvc.exe
• agntsvc.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• sqlservr.exe
• thebat64.exe
• thunderbird.exe
• winword.exe
• wordpad.exe

Dropping Routine

This Ransomware drops the following files:

• %Windows%\{Random 20 character string}.png
• %User Temp%\{Random 20 character string}.jpg
• {Drive letter}:\{Random string derived from Volume Serial Number}.goodgame
• \{Server Host Name}\{Encrypted Folder}\{Random string derived from Volume Serial Number}.goodgame

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Ransomware adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.venus

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.venus\DefaultIcon

It does the following:

• It encrypts files found in the following drive types:
  • Fixed drive
  • Removable drive
  • Network drive
• It changes the icons of encrypted files with the following image:
  

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• venus
• README.txt
• README.html

It avoids encrypting files found in the following folders:

• Tor Browser
• Windows
• dropbox
• iexplorer

It appends the following extension to the file name of the encrypted files:

• .venus

It drops the following file(s) as ransom note:

• {Drive letter}:\README.html
  
• %User Temp%\{Random 20 character string}.hta