RANSOM_WANNAPEACE.THDBOAH

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

It encrypts files with specific file extensions. It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Current Directory of Malware}\RansSIRIA.exe
• {Current Directory of Malware}\RsSIRIA.exe.Config

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
DirectDraw\MostRecentApplication
Name = {Malware File Name}.exe

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\DOMStorage\horacerta.com.br
(Default) = 24

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• www.{BLOCKED}ool.com

It connects to the following website to send and receive information:

• http://{BLOCKED}707.{BLOCKED}/

It connects to the following time servers to determine the current date:

• http://www.{BLOCKED}rta.com.br/

It does the following:

• It displays the following fake Word loading screen upon execution:
  • 
• It does not proceed to its encryption routine if the current system is not located in Brazil
• It connects to the following website upon successful encryption:
  • https://{BLOCKED}/qNxDFP

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .123
• .3dm
• .3ds
• .3g2
• .3gp
• .602
• .7z
• .ARC
• .PAQ
• .accdb
• .ai
• .asc
• .asf
• .asm
• .asp
• .avi
• .backup
• .bak
• .bat
• .bmp
• .brd
• .bz2
• .c
• .cgm
• .class
• .cmd
• .cpp
• .crt
• .cs
• .csr
• .csv
• .db
• .db2
• .db3
• .dbc
• .dbf
• .dch
• .der
• .dif
• .dip
• .djvu
• .doc
• .docb
• .docm
• .docx
• .dot
• .dotm
• .dotx
• .dwg
• .edb
• .eml
• .fla
• .flv
• .frm
• .gdb
• .gif
• .gpg
• .gz
• .h
• .hwp
• .ib
• .ibd
• .itdb
• .jar
• .java
• .jpeg
• .jpg
• .js
• .jsp
• .key
• .lay
• .lay6
• .ldf
• .lnk
• .m3u
• .m4u
• .max
• .mdb
• .mdf
• .mht
• .mid
• .mkv
• .mml
• .mov
• .mp3
• .mp4
• .mpeg
• .mpg
• .msg
• .myd
• .myi
• .ndf
• .nef
• .odb
• .odg
• .odp
• .ods
• .odt
• .onetoc2
• .ost
• .otg
• .otp
• .ots
• .ott
• .p12
• .pas
• .pdf
• .pem
• .pfx
• .php
• .pl
• .png
• .pot
• .potm
• .potx
• .ppam
• .pps
• .ppsm
• .ppsx
• .ppt
• .pptm
• .pptx
• .ps1
• .psd
• .pst
• .py
• .rar
• .raw
• .rb
• .rtf
• .sch
• .scx
• .sdf
• .sh
• .sldm
• .sldx
• .slk
• .sln
• .snt
• .sql
• .sqlite
• .sqlite3
• .sqlitedb
• .stc
• .std
• .sti
• .stw
• .suo
• .svg
• .swf
• .sxc
• .sxd
• .sxi
• .sxm
• .sxw
• .tar
• .tbk
• .tgz
• .tif
• .tiff
• .txt
• .uop
• .uot
• .vb
• .vcd
• .vdi
• .vmdk
• .vmx
• .vob
• .vsd
• .vsdx
• .wav
• .wb2
• .wdb
• .wk1
• .wks
• .wma
• .wmv
• .xlc
• .xld
• .xlm
• .xls
• .xlsb
• .xlsm
• .xlsx
• .xlt
• .xltm
• .xltx
• .xlw
• .zip

It encrypts files found in the following folders:

• %Windows%
• %Program Files%
• %ProgramData%

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)