Ransom.Win32.MOALOA.THGOEAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It scans the computer for registry keys related to antivirus and security applications. This action allows the malware to possibly avoid detection in the computer.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Desktop%\ids.txt → contains the encryption key and available drives
• %All Users Profile%\local\.{Machine's GUID}
• {Encrypted Directory}\.{Machine's GUID} → contains the encryption key

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It adds the following processes:

• vssadmin delete shadows /all /quiet → Delete all shadow copies
• reg delete \"HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\" /va /f
• reg delete \"HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\" /f
• reg add \"HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\"
• for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil cl \"%1\"

It creates the following folders:

• %All Users Profile%\local

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
WindowsUpdateCheck = {Malware Path and Filename}.exe

It adds the following lines or registry entries as part of its routine:

• HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\

Other System Modifications

This Ransomware deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Default

It scans the system for the following registry keys, which are related to antivirus and security applications:

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\HomeGroup
DisableHomeGroup = {Default}

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = {Default}

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows Defender\Policy Manager

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows Defender\Real-time Protection
DisableRealTimeMonitoring = {Default}

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows Defender\Real-time Protection
DisableBehaviorMonitoring = {Default}

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows Defender\Real-time Protection
DisableOnAccessProtection = {Default}

Other Details

This Ransomware does the following:

• Disable the following service using the following commands:
  
  • sc config browser → Configure Browser Settings
  • sc config browser start=enabled → Enable Browser start-u
  • sc stop vss → Stop Volume shadow copy service
  • sc config vss start=disabled → Disable Volume shadow cop
  • sc stop MongoDB →
  • sc config MongoDB start=disabled
  • sc stop SQLWriter
  • sc config SQLWriter start=disabled
  • sc stop MSSQLServerOLAPService
  • sc config MSSQLServerOLAPService start=disabled
  • sc stop MSSQLSERVER
  • sc config MSSQLSERVER start=disabled
  • sc stop MSSQL$SQLEXPRESS
  • sc config MSSQL$SQLEXPRESS start=disabled
  • sc stop ReportServer
  • sc config ReportServer start=disabled
  • sc stop OracleServiceORCL
  • sc config OracleServiceORCL start=disabled
  • sc stop OracleDBConsoleorcl
  • sc config OracleDBConsoleorcl start=disabled
  • sc stop OracleMTSRecoveryService
  • sc config OracleMTSRecoveryService start=disabled
  • sc stop OracleVssWriterORCL
  • sc config OracleVssWriterORCL start=disabled
  • sc stop MySQL
  • sc config MySQL start=disabled
• It avoids encrypting the following files:
  
  • HOW TO BACK YOUR FILES.TXT
  • .{Machine's GUID}
  • {Malware Filename}.exe
  • Windows
  • bootmgr
  • pagefile.sys
  • boot
  • ids.txt
  • NTUSER.DAT
  • Perflogs

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• Tiger4444

It leaves text files that serve as ransom notes containing the following text:

• HOW TO BACK YOUR FILES.TXT