Ransom.Win64.RHYSIDA.THEBBBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Public%\bg.jpg

Agrega los procesos siguientes:

• cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v Wallpaper /f
• cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
• cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
• cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%Public%\bg.jpg" /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "%Public%\bg.jpg" /f
• cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
• cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
• rundll32.exe user32.dll,UpdatePerUserSystemParameters
• cmd.exe /c start powershell.exe -WindowStyle Hidden -Command Sleep -Milliseconds 500; Remove-Item -Force -Path "{Malware File Path}\{Malware File Name}" -ErrorAction SilentlyContinue; → executed to delete itself after execution

Otras modificaciones del sistema

Cambia el fondo de escritorio mediante la modificación de las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
ActiveDesktop
NoChangingWallPaper = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
Wallpaper = %Public%\bg.jpg

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 2

(Note: The default value data of the said registry entry is 0.)

Este malware establece la imagen siguiente como fondo de escritorio del sistema:

• %Public%\bg.jpg
  

Otros detalles

Hace lo siguiente:

• It displays its activity on the console.
• It initializes resources based on the number of processors available in the system.
• It encrypts all system drives from A to Z.
• It deletes itself after execution.
• It displays the following after execution: