Ransom.Win32.TARGETCOMP.SMYXCLAZ

November 18, 2024

Analysis by: Raighen Sanchez

ALIASES:

Ransom.Mallox.S28994722 (QUICKHEAL), Ransom:Win32/GarrantDecrypt.PA!MTB (MICROSOFT)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Ransomware
Destructiveness: No
Encrypted: Yes
In the wild: Yes

OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note. It avoids encrypting files with the following file extensions.

TECHNICAL DETAILS

File Size:

144,896 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

29 Aug 2023

Payload:

Connects to URLs/IPs, Modifies system registry, Steals information, Collects system information, Disables AV, Terminates processes, Encrypts files

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

vssadmin.exe delete shadows /all /quiet
cmd.exe /cbcedit /set {current} bootstatuspolicy ignorefailures
cmd.exe /c bcedit /set {current} recoveryenabled no
sc delete {name of service}
taskkill -f -im {name of process}

Autostart Technique

This Ransomware starts the following services:

mallox

Other System Modifications

This Ransomware modifies the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0 → no time limit for remote desktop connection

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
shutdownwithoutlogon = 0 → prevents user from shutting down without logging on first

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0 → immediately disconnect after idling

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0 → immediately log off after disconnection of remote desktop connection

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
Hide
ShutDown = 0 → hides shut down option

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
Hide
Restart = 0 → hides restart option

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
Hide
SignOut = 0 → hides sign out option

It deletes the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\Raccine → ransomware protection tool

HKEY_LOCAL_MACHINE\SOFTWARE\Raccine → ransomware protection tool

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vssadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wmic.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wbadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bcdedit.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
powershell.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
diskshadow.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
net.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskkill.exe

Propagation

This Ransomware drops the following copy/copies of itself in remote admin shares:

\224.0.0.22\admin$\mallox.exe

Process Termination

This Ransomware terminates the following services if found on the affected system:

MSSQLFDLauncher
MSSQLSERVER
SQLSERVERAGENT
SQLBrowser
SQLTELEMETRY
MsDtsServer130
SSISTELEMETRY130
SQLWriter
MSSQL$VEEAMSQL2012
SQLAgent$VEEAMSQL2012
MSSQL
SQLAgent
MSSQLServerADHelper100
MSSQLServerOLAPService
MsDtsServer100
ReportServer
SQLTELEMETRY$HL
TMBMServer
MSSQL$PROGID
MSSQL$WOLTERSKLUWER
SQLAgent$PROGID
SQLAgent$WOLTERSKLUWER
MSSQLFDLauncher$OPTIMA
MSSQL$OPTIMA
SQLAgent$OPTIMA
ReportServer$OPTIMA
msftesql$SQLEXPRESS
postgresql-x64-9.4

It terminates the following processes if found running in the affected system's memory:

sqlbrowser.exe
sqlwriter.exe
sqlservr.exe
msmdsrv.exe
MsDtsSrvr.exe
sqlceip.exe
fdlauncher.exe
Ssms.exe&&taskkill -f -imSQLAGENT.EXE
fdhost.exe
fdlauncher.exe
sqlservr.exe
ReportingServicesService.exe
msftesql.exe
pg_ctl.exe
postgres.exe

Information Theft

This Ransomware gathers the following data:

Hostname
System Architecture
Number of Processors
Local IP Address
System Locale
OS Version
System Volume Information

It stores collected data in the following file(s):

{malware path}\TargetInfo.txt

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

https://{BLOCKED}s.io/QWEwqdsvsf/ap.php

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

{BLOCKED}ify.org

It does the following:

It only encrypts files with a files size that is greater than or equal to 10kB.
It terrminates itself if the following countries were found in the affected system:
- Russian
- Kazakh
- Belarusian
- Ukrainian
- Tatar
It blocks any system shutdown / reboot and displays the following message:
- Do NOT shutdown OR reboot your PC: this might damage your files permanently !
It encrypts from local drives, removable drives, and network shares.

It accepts the following parameters:

-l
-d
-p
-path {path to encrypt}

Ransomware Routine

This Ransomware encrypts files with the following extensions:

bak
zip
rar
7z
gz
sql
mdf
hdd
vhd
vdi
vmx
vmdk
nvram
vmem
vmsn
vmsd
vmss
lck
vhdx
vhd
dbf
ora
oraenv
dmp
ibd
mdb
smd
mdb

It avoids encrypting files with the following strings in their file name:

desktop.ini
ntuser.dat
thumbs.db
iconcache.db
ntuser.ini
ntldr
bootfont.bin
ntuser.dat.log
bootsect.bak
boot.ini
autorun.inf
debugLog.txt
TargetInfo.txt
mallox.exe
FILE RECOVERY.txt

It avoids encrypting files with the following strings in their file path:

msocache
$windows.~ws
system volume information
intel
appdata
perflogs
programdata
google
application data
tor browser
boot
$windows.~bt
mozilla
boot
windows.old
Windows Microsoft.NET
WindowsPowerShell
Windows NT
Windows
Common Files
Microsoft Security Client
Internet Explorer
Reference
Assemblies
Windows Defender
Microsoft ASP.NET
Core Runtime
Package
Store
Microsoft Help Viewer
Microsoft MPI
Windows Kits
Microsoft.NET
Windows Mail
Microsoft Security Client
Package Store
Microsoft Analysis Services
Windows Portable Devices
Windows Photo Viewer
Windows Sidebar

It appends the following extension to the file name of the encrypted files:

{original filename}.{original extension}.mallox

It drops the following file(s) as ransom note:

{all affected directories}\FILE RECOVERY.txt

It avoids encrypting files with the following file extensions:

msstyles
icl
idx
avast
rtp
mallox
sys
nomedia
dll
hta
cur
lock
cpl
Globeimposter-Alpha865qqz
ics
hlp
com
spl
msi
key
mpa
rom
drv
bat
386
adv
diangcab
mod
scr
theme
ocx
prf
cab
diagcfg
msu
cmd
ico
msc
ani
icns
diagpkg
deskthemepack
wpx
msp
bin
themepack
shs
nls
exe
lnk
ps1
mallox

SOLUTION

Minimum Scan Engine:

9.800

FIRST VSAPI PATTERN FILE:

18.156.08

FIRST VSAPI PATTERN DATE:

26 Dec 2022

VSAPI OPR PATTERN File:

18.157.00

VSAPI OPR PATTERN Date:

27 Dec 2022

Step 1

Trend Micro Predictive Machine Learning detects and blocks malware at the first sign of its existence, before it executes on your system. When enabled, your Trend Micro product detects this malware under the following machine learning name:

TROJ.Win32.TRX.XXPE50FFF071

Step 2

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 3

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 4

Disable this malware service

[ Learn More ]

mallox

Step 5

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
shutdownwithoutlogon = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\Hide
ShutDown = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\Hide
Restart = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\Hide
SignOut = 0

To restore the registry value this malware/grayware modified:

Open Registry Editor.
» For Windows 7 and Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
In the right panel, locate the registry value:
shutdownwithoutlogon = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
shutdownwithoutlogon = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
In the right panel, locate the registry value:
MaxConnectionTime = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
MaxConnectionTime = {default}
Again In the right panel, locate the registry value:
MaxDisconnectionTime = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
MaxDisconnectionTime = {default}
Again In the right panel, locate the registry value:
MaxIdleTime = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
MaxIdleTime = {default}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\Hide
In the right panel, locate the registry value:
ShutDown = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
ShutDown = 1
Again In the right panel, locate the registry value:
Restart = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
Restart = 1
Again In the right panel, locate the registry value:
SignOut = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
SignOut = 1
Close Registry Editor.

Step 6

Search and delete these files

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

{all affected directories}\FILE RECOVERY.txt
{malware path}\TargetInfo.txt

Step 7

Scan your computer with your Trend Micro product to delete files detected as Ransom.Win32.TARGETCOMP.SMYXCLAZ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

Step 8

Restore encrypted files from backup.

Did this description help? Tell us how we did.

Ransom.Win32.TARGETCOMP.SMYXCLAZ

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Related Blog Entries

資源

支援

關於趨勢科技

香港暨澳門辦事處

Ransom.Win32.TARGETCOMP.SMYXCLAZ

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Related Blog Entries

資源

支援

關於趨勢科技

香港暨澳門辦事處

美洲

中東及非洲

歐洲

亞太地區