Ransom.Win64.LIVETEAM.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Malware File Path}\{Victim ID}.jpg → Deleted afterwards
• {Malware File Path}\wallpaper.ps1 → Deleted afterwards

It adds the following processes:

• %System%\cmd.exe /c powershell -ExecutionPolicy Bypass -File "{Malware File Path}\wallpaper.ps1"
• cmd /c "bcdedit /set {current} recoveryenabled no"
• cmd /c "bcdedit /set {default} recoveryenabled no"
• cmd /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
• cmd /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
• cmd /c \"vssadmin Delete Shadows /All /Quiet\""
• cmd /c "taskkill /F /IM {Target Process}*
• cmd /c net stop "{Target Service}" /y
• cmd /c "wevtutil cl application"
• cmd /c "wevtutil cl security"
• cmd /c "wevtutil cl system"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

• {Malware File Path}\{Victim ID}.jpg
  

Process Termination

This Ransomware terminates the following services if found on the affected system:

• via net stop /y:
  • MSSQLFDLauncher
  • MSSQLSERVER
  • SQLSERVERAGENT
  • SQLBrowser
  • SQLTELEMETRY
  • SQLWriter
  • MSSQL
  • SQLAgent
  • MSSQLServerOLAPService

It terminates the following processes if found running in the affected system's memory:

• via taskkill /F /IM:
  • postgresql
  • sqlbrowser
  • sqlwriter
  • sqlservr
  • sqlceip
  • SQLAGENT
  • sqlservr
  • pg_ctl
  • postgres

Other Details

This Ransomware accepts the following parameters:

• -s, --self {Malware file path} - Used to execute the malware if it failes to determine the self-path and load settings.
• -h, --help - Displays help information.
• -c, --directory {Directory} - Encryp all files in the specified directory.
• -dr, --deleteRestorePoints {True/False} - Deletion of system restore points.
• -ss, --stopServices {True/False} - Stops the embedded list of services.
• -sp, --stopProcesses {True/False} - Terminate the embedded list of processes.
• -dn, --dropNote {True/False} - Drops ransom note to a specific directory.
• -cw, --changeWallpaper {False} - Disable modification of desktop wallpaper.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .LIVE

It drops the following file(s) as ransom note:

• %Public%\Documents\FILE RECOVERY_ID_{Victim ID}.txt
• %Public%\Desktop\FILE RECOVERY_ID_{Victim ID}.txt
• {Malware File Path}\FILE RECOVERY_ID_{Victim ID}.txt
• {Encrypted Directory}\FILE RECOVERY_ID_{Victim ID}.txt
  

It avoids encrypting files with the following file extensions:

• exe
• dll
• ink
• ini
• lnk
• ico
• sys
• mui
• live
• desktop