Ransom.Win32.EMBARGO.THEAFBD

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• "%System%\cmd.exe" /q /c bcdedit /set {default} recoveryenabled no

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• LoadUpOnGunsBringYourFriends

Process Termination

This Ransomware terminates the following services if found on the affected system:

• GxCIMgr$
• MVArmor$
• VSNAPVSS$
• VeeamNFSSvc$
• QBCFMonitorService$
• GxVssHWProv$
• QBDBMgrN$
• BackupExecRPCService$
• VeeamTransportSvc$
• MVarmor64$
• SAPHostControl$
• SAPHostExec$
• QBCFMonitorService$
• MSExchange\$.*$
• AcronisAgent$
• VeeamTransportSvc$
• BackupExecVSSProvider$
• BackupExecManagementService
• SAPD\$$xecManagementSe
• QBIDPService$
• AcrSch2Svc$
• SAPService$
• SAPHostControl$
• BackupExecJobEngine$ce
• BackupExecRPCService$
• GxClMgrS$

It terminates the following processes if found running in the affected system's memory:

• agntsvc.exe
• dbeng50.exe
• dbsnmp.exe
• encsvc.exe
• excel.exe
• firefox.exe
• infopath.exe
• isqlplussvc.exe
• msaccess.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• notepad.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• onenote.exe
• oracle.exe
• outlook.exe
• powerpoint.exe
• sqbcoreservice.exe
• sql.exe
• steam.exe
• synctime.exe
• tbirdconfig.exe
• thebat.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe
• xfssvccon.exe
• *sql*.exe
• bedbh.exe
• vxmon.exe
• benetns.exe
• bengien.exe
• pvlsvr.exe
• beserver.exe
• raw_agent_svc.exe
• vsnapvss.exe
• CagService.exe
• vsnapvss.exe
• QBIDPService.exe
• QBDBMgrN.exe
• QBCFMonitorService.exe
• SAP.exe
• TeamViewer_Service.exe
• TeamViewer.exe
• tv_w32.exe
• tv_x64.exe
• cvd.exe
• cvfwd.exe
• cvods.exe
• saphostexec.exe
• saposcol.exe
• sapstartsrv.exe
• avscc.exe
• DellSystemDetect.exe
• EnterpriseClient.exe
• veeam*.exe
• VeeamNFSSvc.exe
• VeeamTransportSvc.exe
• VeeamDeploymentSvc.exe

Other Details

This Ransomware does the following:

• It attempts to terminate running processes using the Restart Session Manager to encrypt the associated file as such will result to the following registry modification:
  • HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    Owner = {hex values}
  • HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    SessionHash = {hex values}
  • HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    Sequence = 0x01
  • HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    RegFiles{number} = {file}
  • HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    RegFilesHash = {hex values}

It accepts the following parameters:

• -t, --threads {THREADS} → number of thread, leave default to automatic assign [default:0]
• -p, --path {PATH} → path to directory, -p R:\backups\ -p \files01\finance -p \10.0.3.2\D$\Accounting
• --no-delete → disable self-delete
• --partial → enable searching for partially encrypted files and finish encrypting (if a previous run failed)
• -l, --log → enable output to log
• -v, --verbose → enable verbose output
• -f, --follow-sym → enable follow symlinks
• -m, --multi-run → allow more than one instance run on the same host
• --no-net → do not search for network resources to encrypt
• -n, --net-path {NETWORK_PATHS} → list of servers to target, -n 10.0.4.2 -n FILES02.contoso.local-n FILES03
• -h, --help → Print help

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• .cpl
• .sys
• .drv
• d3d9caps.dat
• */NTUSER.DAT
• .lnk
• thumbs.db
• .msi
• .search-ms
• .ico
• .dll
• desktop.ini
• .bat
• .lock
• .deskthemepack
• iconcache.db
• .msc
• .theme
• ntldr
• .themeckpack
• autorun.inf
• d3d9caps.dat
• boot.ini
• .spl
• .exe
• .msstyles
• .cab
• .msu
• .themepack
• .564ba1

It avoids encrypting files with the following strings in their file path:

• %ProgramData%/Microsoft/DeviceSync
• %ProgramData%/Microsoft/Diagnosis
• %ProgramData%/ssh
• %Program Files%/Windows Portable Devices
• %Program Files%/Uninstall Information
• %ProgramData%/regid{random}.com\.microsoft
• %ProgramData%/USOPrivate
• %Program Files%/Windows Defender
• %Program Files%/Windows Media Player
• %Program Files%/Windows Security
• %Program Files%/Windows Photo Viewer
• %Program Files%/ModifiableWindowsApps
• %Program Files%/Internet Explorer
• %Program Files%/Windows NT
• %Program Files%/Windows Sidebar
• %Program Files%/WindowsPowerShell
• %Program Files% \(x86\)/Microsoft\.NET
• %Program Files% \(x86\)/Windows Defender
• %Program Files%/Invisible Things Lab/
• %Program Files% \(x86\)/Microsoft/Temp
• %Program Files% \(x86\)/Windows NT
• %Program Files% \(x86\)/Windows Security
• %Program Files% \(x86\)/Windows Mail
• %Program Files% \(x86\)/Windows Sidebar
• %Program Files% \(x86\)/Common Files
• %Program Files%/Common Files/System
• %Program Files%/Windows Mail
• %ProgramData%/ntuser\.pol
• %ProgramData%/USOShared
• %Program Files%/WindowsApps
• %ProgramData%/Microsoft/UEV
• %ProgramData%/Microsoft/Device Stage
• %ProgramData%/Packages/USOShared
• %ProgramData%/Microsoft/Event Viewer
• %ProgramData%/Microsoft/Provisioning
• %ProgramData%/Microsoft/IdentityCRL
• %ProgramData%/Microsoft/NetFramework
• %ProgramData%/Microsoft/Spectrum
• %ProgramData%/Microsoft/Windows Defender
• %ProgramData%/Microsoft/MapData
• %ProgramData%/Microsoft/WDF
• %ProgramData%/Microsoft/Storage Health
• %ProgramData%/Microsoft/Windows
• %ProgramData%/Microsoft/Search
• %ProgramData%/Microsoft/Vault
• %ProgramData%/Microsoft/SmsRouter
• %ProgramData%/Microsoft/Speech_OneCore
• %ProgramData%/Microsoft/Windows NT
• %ProgramData%/Microsoft/MF
• %ProgramData%/Microsoft/Network
• %ProgramData%/Microsoft/WinMSIPC
• %ProgramData%/Microsoft/WPD
• %ProgramData%/Microsoft/EdgeUpdate
• %ProgramData%/Packages/USOPrivate
• %ProgramData%/Microsoft/DRM
• %ProgramData%/USOShared

It appends the following extension to the file name of the encrypted files:

• .564ba1

It drops the following file(s) as ransom note:

• {Encrypted Directory}\HOW_TO_RECOVER_FILES.txt