Ransom.Win32.MEDUSA.THJAFAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

It encrypts files found in specific folders. It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %Application Data%\svchostt.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• vssadmin.exe Delete Shadows /All /Quiet
• bcdedit.exe /set {default} recoveryenabled No
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• wbadmin DELETE SYSTEMSTATEBACKUP
• wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
• wmic.exe SHADOWCOPY /nointeractive

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {8761ABBD-7F85-42EE-B272-A76179687C63}

Autostart Technique

This Ransomware starts the following services:

• LanmanWorkStation

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\Medusa

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\SOFTWARE\Medusa
Name = {Malware File Name}

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = {HEX VALUES}

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = {HEX VALUES}

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = {HEX VALUES}

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = {HEX VALUES}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkedConnections = 1

Propagation

This Ransomware does not have any propagation routine.

Backdoor Routine

This Ransomware does not have any backdoor routine.

Rootkit Capabilities

This Ransomware does not have rootkit capabilities.

Process Termination

This Ransomware terminates the following services if found on the affected system:

• wrapper
• DefWatch
• ccEvtMgr
• ccSetMgr
• SavRoam
• sqlservr
• sqlagent
• sqladhlp
• Culserver
• RTVscan
• sqlbrowser
• SQLADHLP
• QBIDPService
• Intuit.QuickBooks.FCS
• QBCFMonitorService
• sqlwriter
• msmdsrv
• tomcat6
• zhudongfangyu
• SQLADHLP
• vmware-usbarbitator64
• vmware-converter
• dbsrv12
• dbeng8

It terminates the following processes if found running in the affected system's memory:

• wxServer.exe
• wxServerView
• sqlservr.exe
• sqlmangr.exe
• RAgui.exe
• supervise.exe
• Culture.exe
• RTVscan.exe
• Defwatch.exe
• sqlbrowser.exe
• winword.exe
• QBW32.exe
• QBDBMgr.exe
• qbupdate.exe
• QBCFMonitorService.exe
• axlbridge.exe
• QBIDPService.exe
• httpd.exe
• fdlauncher.exe
• MsDtSrvr.exe
• tomcat6.exe
• java.exe
• 360se.exe
• 360doctor.exe
• wdswfsafe.exe
• fdlauncher.exe
• fdhost.exe
• GDscan.exe
• ZhuDongFangYu.exe

Information Theft

This Ransomware does not have any information-stealing capability.

Other Details

This Ransomware does the following:

• This ransomware can perform privilege escalation
• This ransomware affects all existing drives in the system
• It terminates itself if the system locale found in the sys is the following:
  • Central Kurdish
  • Russian
  • Arabic Countries

It adds the following scheduled tasks:

• Task Name:svchostt
  Task Action:%Application Data%\svchostt.exe
  Task Trigger:Once installed, and every 15 minutes after indefinitely

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• Program Files\Microsoft\Exchange Server
• Program Files (x86)\Microsoft\Exchange Server
• Program Files\Microsoft SQL Server
• Program Files (x86)\Microsoft SQL Server

It avoids encrypting files found in the following folders:

• %User Profile%\AppData
• \ProgramData
• \Program Files
• \Program Files (x86)
• \AppData
• \Application Data
• \intel
• \nvidia
• \Users\All Users
• \Windows

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It appends the following extension to the file name of the encrypted files:

• .encrypted

It drops the following file(s) as ransom note:

• HOW_TO_RECOVER_DATA.html
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .sys
• .ini
• .lnk
• .rdp
• .encrypted

NOTES:

It does not exploit any vulnerability.