Ransom.Win32.AGENDA.C

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\QLOG\ThreadId(number).LOG.txt → logs execution status
  

It adds the following processes:

• {malware filepath}/{malware filename} --password {string} --escalated --parent-sid {SID}
• "cmd" /C fsutil behavior set SymlinkEvaluation R2R:1
• "cmd" /C fsutil behavior set SymlinkEvaluation R2L:1
• "cmd" /C net use
• "cmd" /C wmic service where name='vss' call ChangeStartMode Manual
• "cmd" /C net start vss
• "cmd" /C vssadmin.exe delete shadows /all /quiet
• "cmd" /C net stop vss
• "cmd" /C wmic service where name='vss' call ChangeStartMode Disabled
• "powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)}

It creates the following folders:

• %User Temp%\QLOG

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Ransomware modifies the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkedConnections = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\LanmanServer\Parameters
MaxMpxCt = 65535

Process Termination

This Ransomware terminates the following services if found on the affected system:

• vmms
• mepocs
• memtas
• veeam
• backup
• vss
• sql
• msexchange
• sophos
• msexchange\$
• wsbexchange
• pdvfsservice
• backupexecvssprovider
• backupexecagentaccelerator
• backupexecagentbrowser
• backupexecdivecimediaservice
• backupexecjobengine
• backupexecmanagementservice
• backupexecrpcservice
• gxblr
• gxvss
• gxclmgrs
• gxcvd
• gxcimgr
• gxmmm
• gxvsshwprov
• gxfwd
• sapservice
• sap
• sap\$
• sapd\$
• saphostcontrol
• saphostexec
• qbcfmonitorservice
• qbdbmgrn
• qbidpservice
• acronisagent
• veeamnfssvc
• veeamdeploymentservice
• veeamtransportsvc
• mvarmor
• mvarmor64
• vsnapvss
• acrsch2svc
• (.*?)sql(.*?)

It terminates the following processes if found running in the affected system's memory:

• vmms
• vmwp
• vmcompute
• agntsvc
• dbeng50
• dbsnmp
• encsvc
• excel
• firefox
• infopath
• isqlplussvc
• sql
• msaccess
• mspub
• mydesktopqos
• mydesktopservice
• notepad
• cautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• powerpnt
• sqbcoreservice
• steam
• ynctime
• tbirdconfig
• thebat
• thunderbird
• visio
• winword
• wordpad
• xfssvccon
• bedbh
• vxmon
• benetns
• bengien
• pvlsvr
• beserver
• raw_agent_svc
• vsnapvss
• cagservice
• qbidpservice
• qbdbmgrn
• qbcfmonitorservice
• sap
• teamviewer_service
• teamviewer
• tv_w32
• tv_x64
• cvmountd
• cvd
• cvfwd
• cvods
• saphostexec
• saposcol
• sapstartsrv
• avagent
• avscc
• dellsystemdetect
• enterpriseclient
• veeamnfssvc
• veeamtransportsvc
• veeamdeploymentsvc
• mvdesktopservice

Information Theft

This Ransomware gathers the following data:

• Hostname
• Username

Other Details

This Ransomware does the following:

• It requires the correct password to proceed in its intended routine.
• It terminates itself if it detects that the sample is being executed in a virtual environment.
• It uses the CPUID assembly instruction to check if the sample is being executed in a virtual machine.
• The company ID in the ransom note is the same as the extension that it wil append to enrypted files.
• It encrypts local and shared/network drives.
• Impersonates the privileges of the following process:
  • lsass.exe
  • winlogon.exe
  • wininit.exe
• It logs its activities in a console.
  

It accepts the following parameters:

• --password {string} → password to enter before proceeding with its intended routine
• --paths {directory} → defines the path that parses directories; if this flag is used and left empty, all directories will be scanned
• --ips {IP address} → allows providing of ip addresses
• --excludes {directory} → exclude directory for encryption
• --timer → time delay before execution
• --no-sandbox → disable sandbox detection
• --no-escalate → execute without admin privileges
• --impersonate
• --safe → execute in safe mode
• --no-local
• --no-domain
• --no-network
• --no-ef
• --no-ff
• --no-df
• --no-proc
• --no-services
• --no-vmkill-cluster
• --no-extension
• --no-wallpaper
• --no-note
• --no-delete
• --no-destruct
• --no-zero
• --print-image
• --print-delay
• --force
• --spreads
• --debugspread
• --spread-vcenter
• --dry-run
• --escalated
• --parent-sid
• --spread-process

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• desktop.ini
• autorun.ini
• ntldr
• bootsect.bak
• thumbs.db
• boot.ini
• ntuser.dat
• iconcache.db
• bootfont.bin
• ntuser.ini
• ntuser.dat.log
• autorun.inf
• bootmgr
• bootmgr.efi
• bootmgfw.efi
• #recycle

It avoids encrypting files with the following strings in their file path:

• .
• ..
• windows
• system volume information
• intel
• admin$
• ipc$
• sysvol
• netlogon
• $windows.~ws
• application data
• mozilla
• program files (x86)
• program files
• $windows.~bt
• msocache
• tor browser
• programdata
• boot
• config.msi
• google
• perflogs
• appdata
• windows.old
• $recycle.bin

It renames encrypted files using the following names:

• {original filename}.{original file extension}.ytY81v7ip.1

It drops the following file(s) as ransom note:

• {All available directories}/README-RECOVER-ytY81v7ip.txt
  

It avoids encrypting files with the following file extensions:

• themepack
• nls
• diapkg
• msi
• lnk
• exe
• scr
• bat
• drv
• rtp
• msp
• prf
• msc
• ico
• key
• ocx
• diagcab
• diagcfg
• pdb
• wpx
• hlp
• icns
• rom
• dll
• msstyles
• mod
• ps1
• ics
• hta
• bin
• cmd
• ani
• 386
• lock
• cur
• idx
• sys
• com
• deskthemepack
• shs
• theme
• mpa
• nomedia
• spl
• cpl
• adv
• icl
• msu
• -ytY81v7ip