Ransom.MSIL.TARGETCOMP.THBBGBC

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

特定のファイル拡張子を持つファイルを暗号化します。 身代金要求文書のファイルを作成します。 以下のファイル拡張子を持つファイルは暗号化しません。

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のプロセスを追加します。

• "%System%\powershell.exe" -ENC cwBOAGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
• cmd /c "%User Temp%\Belueqlpobiymhezugmbdpkiller.bat"
• cmd /c "color b & taskkill /F /IM {Process name}
• cmd /c "color b & net stop "{Service Name}"
• cmd /c "color b & sc config {Service Name} start=disabled
• cmd /c "color b & @sc delete {Service Name}
• vssadmin.exe delete shadows /all /quiet
• %System%\cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
• %System%\cmd.exe /c bcdedit /set {current} recoveryenabled no

(註：%System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

自動実行方法

マルウェアは、以下のファイルを作成します。

• %User Temp%\Belueqlpobiymhezugmbdpkiller.bat ← contains commands to delete and stop services as well as to terminate processes, deleted afterwards.
• {Malware File Path}\TargetInfo.txt ← Contains system information
• %System Root%\HOW TO RECOVER !!.TXT

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.)

他のシステム変更

マルウェアは、以下のレジストリ値を変更します。

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start
HideShutDown = 1

(註：変更前の上記レジストリ値は、「0」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start
HideRestart = 1

(註：変更前の上記レジストリ値は、「0」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start
HideSignOut = 1

(註：変更前の上記レジストリ値は、「0」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CurrentVersion\Policies\System
shutdownwithoutlogon = 0

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0

マルウェアは、以下のレジストリキーを削除します。

HKEY_CURRENT_USER\SOFTWARE\Raccine

HKEY_LOCAL_MACHINE\SOFTWARE\Raccine

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\EventLog\Application\
Raccine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vssadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wmic.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wbadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
powershell.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
diskshadow.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
net.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskkill.exe

感染活動

マルウェアは、以下のファイル名を用いて、ネットワーク共有フォルダ内に自身のコピーを作成します。

• mallox.exe

プロセスの終了

マルウェアは、感染コンピュータ上で確認した以下のサービスを終了します。

• 2345PicSvc
• 360EntClientSvc
• 360EntHttpServer
• 360EntPGSvc
• 360EntSvc
• ABBYY.Licensing.FineReader.Professional.12.0
• abs_deployer
• AdobeARMservice
• ADWS
• AgentX
• AGSService
• AHS SERVICE
• Alibaba Security Aegis Detect Service
• Alibaba Security Aegis Update Service
• AlibabaProtect
• AliyunService
• allpass_redisservice_port21160
• AngelOfDeath
• Apache2.2
• Apache2.4
• apachezt
• AppFabricCachingService
• Apple Mobile Device Service
• asComSvc
• aspnet_state @sc delete Redis
• AutoUpdatePatchService
• AutoUpdateService
• BackupExecAgentAccelerator
• BackupExecAgentBrowser
• BackupExecDeviceMediaService
• BackupExecJobEngine
• BackupExecManagementService
• BackupExecRPCService
• bedbg
• BestSyncSvc
• Bonjour Service
• btPanel
• c2wts
• CASLicenceServer
• CASMsgSrv
• CASVirtualDiskService
• CASWebServer
• CASXMLService
• cbVSCService
• cbVSCService11
• ceng_web_svc_d
• CIS
• ClickToRunSvc
• CloudExchangeService
• CobianBackup10
• CobianBackup11
• d_safe
• Daemon Service
• DAService_TCP
• DDNSService
• DDVRulesProcessor
• Dell Hardware Support
• DellDRLogSvc
• DFServ
• DGPNPSEV
• EASService
• EasyFZS Server
• eCardMPService
• eCard-TTransServer
• edr_monitor
• EnergyDataServic
• ErpEnvSvc
• eSightService
• EvtSys
• FileZilla Server
• FirebirdGuardianDeafaultInstance
• FirebirdServerDefaultInstance
• Flash Helper Service
• FlexNet Licensing Service 64
• FontCache3.0.0.0
• FTA
• ftnlses3
• ftnlsv3
• ftusbrdsrv
• ftusbrdwks
• FxService
• Gailun_Downloader
• GNWebService
• GPSDaemon
• GPSDataProcSvr
• GPSDownSvr
• GPSFtpd
• GPSGatewaySvr
• GPSLoginSvr
• GPSMediaSvr
• GPSMysqld
• GPSStorageSvr
• GPSTomcat6
• GPSUserSvr
• HaoZipSvc
• igfxCUIService2.0.0.0
• ImeDictUpdateService
• ImtsEventSvr
• iNethinkSQLBackupSvc
• IngressMgr
• IpOverUsbSvc
• Jenkins
• jhi_service
• JhTask
• JWEM3DBAUTORun
• JWRinfoClientService
• JWService
• K3ClouManager
• K3MMainSuspendService
• K3MobileService
• K3MobileServiceManage
• kbasesrv
• KICkSvr
• Kiwi Syslog Server
• KMSELDI
• KpService
• KuaiYunTools
• KugouService
• LMS
• LPManager
• MASTER
• MCService
• MDM
• MediatekRegistryWriter
• memcached Server
• MMRHookService
• MotionBoard57
• MotionBoardRCService57
• MSComplianceAudit
• MSCRMAsyncService
• MSCRMAsyncService$maintenance
• MSCRMUnzipService
• MSDTC
• MsDtsServer100
• MsDtsServer130
• MSExchangeADTopology
• MSExchangeAntispamUpdate
• MSExchangeCompliance
• MSExchangeDagMgmt
• MSExchangeDelivery
• MSExchangeDiagnostics
• MSExchangeEdgeSync
• MSExchangeFastSearch
• MSExchangeFrontEndTransport
• MSExchangeHM
• MSExchangeHMRecovery
• MSExchangeImap4
• MSExchangeIMAP4BE
• MSExchangeIS
• MSExchangeMailboxAssistants
• MSExchangeMailboxReplication
• MSExchangeNotificationsBroker
• MSExchangePop3
• MSExchangePOP3BE
• MSExchangeRepl
• MSExchangeRPC
• MSExchangeServiceHost
• MSExchangeSubmission
• MSExchangeThrottling
• MSExchangeTransport
• MSExchangeTransportLogSearch
• MSExchangeUM
• MSExchangeUMCR
• msftesql$SQLEXPRESS
• MSMQ
• MSOLAP$SHOPCONTROL9
• MSSEARCH & @sc delete msftesql
• MSSQL
• MSSQL$
• MSSQL$FE_EXPRESS
• MSSQL$OPTIMA
• MSSQL$PROGID
• MSSQL$RE_EXPRESS
• MSSQL$SHOPCONTROL9
• MSSQL$SQL2008
• MSSQL$VEEAMSQL2012
• MSSQL$VIM_SQLEXP
• MSSQL$WOLTERSKLUWER
• MSSQLFDLauncher
• MSSQLFDLauncher$OPTIMA
• MSSQLFDLauncher$SHOPCONTROL9
• MSSQLSERVER
• MSSQLServerADHelper100
• MSSQLServerOLAPService
• Mysoft.Autoupgrade.DispatchService
• Mysoft.Autoupgrade.UpdateService
• Mysoft.Config.WindowsService
• Mysoft.DataCenterService
• Mysoft.SchedulingService
• Mysoft.Setup.InstallService
• MysoftUpdate
• MySQL
• MySQL5_OA
• mysqltransport
• NetBackup Client Service
• NetBackup Discovery Framework
• NetBackup Legacy Client Service
• NetBackup Legacy Network Service
• NetBackup Proxy Service
• NetBackup SAN Client Fibre Transport Service
• NetVault Process Manager
• NFLicenceServer
• NFOTPService
• NFSysService
• NFVPrintServer
• NFWebServer
• NscAuthService
• Nuo Update Monitor
• OfficeClearCache
• OfficeUpdateService
• OMAILREPORT
• OpenFastAssist
• OpenSSHd
• OracleDBConcoleorcl
• OracleDBConsoleilas
• OracleJobSchedulerORCL
• OracleMTSRecoveryService
• OracleOraDb10g_homeliSQL*Plus
• OracleOraDb11g_home1ClrAgent
• OracleOraDb11g_home1TNSListener
• OracleRemExecService
• OracleServiceORCL
• OracleVssWriterORCL
• OSearch16
• OSP Service
• pcas
• postgresql-x64-9.4
• ProjectCalcService16
• ProjectEventService16
• ProjectQueueService16
• Protect_2345Explorer
• QcSoftService
• qemu-ga
• QPCore
• QQCertificateService
• RaAutoInstSrv_RT2870
• RabbitMQ
• RapidRecoveryAgent
• RapService
• RavService
• RavTask
• Realtek11nSU
• RemoteAssistService
• REPLICA
• ReportServer
• ReportServer$OPTIMA
• ReportServer$SHOPCONTROL9
• ReportServer$SQLEXPRESS
• Rpc Monitor
• RTCASMCU
• RTCATS
• RTCAVMCU
• RTCCDR
• RTCDATAMCU
• RTCIMMCU
• RTCMEETINGMCU
• RtcQms
• RtcSrv
• SAP Business One RSP Agent Service
• SAPB1iDIProxy
• SAPB1iDIProxy_Monitor
• SAPB1iEventSender
• savsvc
• SBOClientAgent
• SBODI_Server
• SBOJobServiceBackEnd
• SBOMail
• SBOWFDataAccess
• SBOWorkflowEngine
• secbizsrv
• semwebsrv
• Sense Shield Service
• SentinelKeysServer
• Service2
• ServiceMid
• Serv-U
• ShareBoxMonitorService
• ShareBoxService
• SiebelApplicationContainer_Siebel_Home_d_Siebel_sai
• smtpsvrJT
• SPAdminV4
• SPSearchHostController
• SPTimerV4
• SPTraceV4
• SQL Server (MSSQLSERVER)
• SQL Server Reporting Services
• SQLAgent
• SQLAgent$OPTIMA
• SQLAgent$PROGID
• SQLAgent$SHOPCONTROL9
• SQLAgent$SQL2008
• SQLAgent$VEEAMSQL2012
• SQLAgent$WOLTERSKLUWER
• SQLANYs_Sage_FAS_Fixed_Assets
• SQLANYs_sem5
• SQLBackupAndFTP Client Service
• SQLBrowser
• SQLSERVERAGENT
• SQLService
• SQLTELEMETRY
• SQLTELEMETRY$HL
• SQLWrite
• SQLWriter
• SSISTELEMETRY130
• SSMonitorService
• SSSyncService
• start crasher cmd /c color b
• SupportAssistAgent
• SyncBASE Service
• Synology Drive VSS Service x64
• TbossSystem
• TCPIDDAService
• TeamViewer
• TeamViewer8
• TMBMServer
• tmlisten
• Tomcat8
• TongBackupSrv
• TPlusStdAppService1220
• TPlusStdAppService1300
• TPlusStdTaskService1220
• TPlusStdTaskService1300
• TPlusStdUpgradeService1220
• TPlusStdUpgradeService1300
• TPlusStdWebService1300
• TurboCRM70
• TxQBService
• U8DispatchService
• U8EISService
• U8EncryptService
• U8GCService
• U8KeyManagePool
• U8MPool
• U8SCMPool
• U8SendMailAdmin
• U8SLReportService
• U8SmsSrv
• U8TaskService
• U8WebPool
• U8WorkerService1
• U8WorkerService2
• UFAllNet
• UFIDAWebService
• UFNet
• UFReportService
• UI0Detect
• UIODetect
• UtilDev Web Server Pro
• UTUService
• UWS HiPriv Services
• UWS LoPriv Services
• VeeamBrokerSvc
• VeeamCatalogSvc
• VeeamCloudSvc
• VeeamDeploySvc
• VeeamDistributionSvc
• VeeamMountSvc
• VeeamNFSSvc
• VeeamTransportSvc
• VeeanBackupSvc
• VGAuthService
• VirboxWebServer
• VisualSVNServer
• vm-agent
• VmAgentDaemon
• VMAuthdService
• VMnetDHCP
• VMTools
• VMUSBArbService
• vmvss
• VMware NAT Service
• vmware-converter-agent
• vmware-converter-server
• vmware-converter-worker
• VMwareHostd
• vss
• vsvnjobsvc
• wampapache
• wanxiao-monitor
• WebAttendServer
• wwbizsrv
• xenlite
• XenSvc
• XT800Service_Personal
• YunService
• Zabbix Agent
• ZTE FileTranS
• ZTE USBIP Client
• ZTE USBIP Client Guard
• ZTEVdservice
• zyb_sync

マルウェアは、感染コンピュータ上で以下のプロセスが常駐されていることを確認した場合、そのプロセスを終了します。

• 2345MiniPage.exe
• 360bdoctor.exe
• 360EnterpriseDiskUI.exe
• abs_deployer.exe
• acrotray.exe
• Admin.exe
• AdobeARM.exe
• AgentX.exe
• AlibabaProtect.exe
• aliwssv.exe
• AllPassCBHost.exe
• AllPassMCService.exe
• AndroidServer.exe
• ap_nginx.exe
• ap_redis-server.exe
• apache.exe
• AppMain.exe
• AppVShNotify.exe
• ApUI.exe
• ASMCUSvc.exe
• aspnet_state.exe
• atkexComSvc.exe
• Att.exe
• Aua.exe
• auaJW.exe
• AutoBackUpEx.exe
• AutoDealService.exe
• AutoUpdate.exe
• AutoUpdateService.exe ← Terminates the specified process and any child processes which were started by it.
• BackupExec.exe
• BackupExecManagementService.exe
• BACSTray.exe
• baidunetdisk.exe
• BarCMService.exe
• BarMoniService.exe
• BarServer.exe
• BarServerView.exe
• bedbg.exe
• benetns.exe
• bengine.exe
• beremote.exe
• beserver.exe
• BestSyncApp.exe
• BsAgent_0.exe
• bschJW.exe
• btPanel.exe
• bugreport.exe
• c2wtshost.exe
• cacls.exe
• CAService.exe
• CasLicenceServer.exe
• cbInterface.exe
• cbService.exe
• cbVSCService11.exe
• ccbService.exe
• CCenter.exe
• CertMgr.exe
• ChatServer.exe
• chrome.exe
• ChsIME.exe
• ClamTray.exe
• ClamWin.exe
• clean.exe
• ClearCache.exe
• Cobian.exe
• cohernece.exe
• ComputerZService.exe
• ComputerZTray.exe
• consent.exe
• ControlServer.exe
• Correspond.exe
• CQA.exe
• CrmAsyncService.exe
• CrmUnzipService.exe
• cygrunsrv.exe
• d_manage.exe
• DAService.exe
• DataCollectorSvc.exe
• DataMCUSvc.exe
• DataShareBox.ShareBoxMonitorService.exe
• DataShareBox.ShareBoxService.exe
• DBServer.exe
• dbsrv12.exe
• dbsrv16.exe
• DDSoftPwsTomcat9.exe
• DefenderDaemon.exe
• Detector.exe
• devenv.exe
• dinotify.exe
• DisklessServer.exe
• Dispatcher.exe
• DistributedCacheService.exe
• DSCPatchService.exe
• DumpServer.exe
• easservice.exe
• EasyFZS.exe
• EdgeTransport.exe
• edr_agent.exe
• edr_monitor.exe
• edr_sec_plan.exe
• EFDispatcher.exe
• EISService.exe
• emagent.exe
• EnergyDataService.exe
• EntDT.exe
• EnterprisePortal.exe
• EntPublish.exe
• eSafe_monitor.exe
• eSightService.exe
• ESLUSBService.exe
• Estimator.exe
• EXCEL.EXE
• Executer.exe
• extjob.exe
• FA_Logwriter.exe
• FastInvoice.exe
• FastInvoiceAssist.exe
• fdhost.exe
• fdlauncher.exe
• FieldAnalyst.exe
• FileTransferAgent.exe
• FileZilla Server Interface.exe
• FileZilla Server.exe
• firefox.exe
• FlashHelperService.exe
• FNPLicensingService.exe
• FNPLicensingService64.exe
• FoxitProtect.exe
• Foxmail.exe
• fppdis5.exe
• fsnotifier.exe
• ftnlses.exe
• ftnlsv.exe
• ftusbrdsrv.exe
• ftusbrdwks.exe
• ftusbsrv.exe
• GameServer.exe
• Gemstar.Group.CRS.Client.exe
• GEUU20003.exe
• GNAupdaemon.exe
• GNCEFExternal.exe
• GNCore.exe
• GnHostService.exe ← Terminates the specified process and any child processes which were started by it.
• gnwayDDNS.exe
• GNWebHelper.exe
• GNWebServer.exe
• GoodGame.exe
• GoodGameSrv.exe
• GoogleCrashHandler.exe
• GoogleCrashHandler64.exe
• GoogleUpdate.exe
• gpsdaemon.exe
• gpsdataprocsvr.exe
• gpsdownsvr.exe
• gpsftpd.exe
• gpsgatewaysvr.exe
• gpsloginsvr.exe
• gpsmediasvr.exe
• gpsmysqld.exe
• gpsstoragesvr.exe
• gpssvrctrl.exe
• gpstomcat6.exe
• gpsusersvr.exe
• gsinterface.exe
• HaoYiShi.exe
• HaoZip.exe
• HaoZipScan.exe
• hasplms.exe
• Helper_Haozip.exe
• hfs.exe
• His6Service.exe
• host.exe
• hostcontrollerservice.exe
• httpd.exe
• HwsHostPanel.exe
• HwUVPUpgrade.exe ← Terminates the specified process and any child processes which were started by it.
• HysMySQL.exe
• IcafeServicesTray.exe
• IDDAService.exe
• idea.exe
• iempwatchdog.exe
• iexplore.exe
• igfxEM.exe
• igfxHK.exe
• igfxTray.exe
• IMEDICTUPDATE.exe
• IMMCUSvc.exe
• ImtsEventSvr.exe
• iMTSSvcMgr.exe
• iNethinkSQLBackup.exe
• iNethinkSQLBackupConsole.exe
• InetMgr.exe
• ipc_proxy.exe
• IpOverUsbSvc.exe
• ispiritPro.exe
• isqlplussvc.exe
• iusb3mon.exe
• java.exe
• jenkins.exe
• JhTask.exe
• JMJ_server.exe
• Jointsky.CloudExchange.NodeService.ein
• Jointsky.CloudExchangeService.exe
• JT_AG-8332.exe
• jucheck.exe
• jusched.exe
• jzmis.exe
• K3MobileService.exe
• K3ServiceUpdater.exe
• kbasesrv.exe
• KDActMGr.exe
• KDdataUpdate.exe ← Terminates the specified process and any child processes which were started by it.
• KDHRServices.exe
• kdmain.exe
• KDSvrMgrService.exe
• Kekcoek.pif
• KICMain.exe
• KICManager.exe
• Kingdee.DeskTool.exe
• Kingdee.K3.CRM.MMC.AutoService.exe
• Kingdee.K3.CRM.MMC.MMCService.exe
• Kingdee.K3.HR.Server.exe
• Kingdee.K3.Mobile.LightPushService.exe
• Kingdee.K3.Mobile.Servics.exe
• Kingdee.K3.PUBLIC.BkgSvcHost.exe
• Kingdee.K3.PUBLIC.KDSvrMgrHost.exe
• Kingdee.k3.Weixin.ClientService.exe
• Kingdee.KIS.UESystemSer.exe ← Terminates the specified process and any child processes which were started by it.
• Kingdee6.1.exe
• KuaiYun.exe
• landingpage.exe
• lantern.exe
• Launchpad.exe
• licenceserver.exe
• LogDataServer.exe
• LoginGate.exe
• LoginSrv.exe
• LogonServer.exe
• LPManNotifier.exe
• LPManService.exe
• lta8.exe
• M2Server.exe
• MainExecute.exe
• MasterReplicatorAgent.exe
• mdm.exe
• MeetingMCUSvc.exe
• MessageNotification.exe
• MgrEnvSvc.exe
• Microsoft.ActiveDirectory.WebServices.exe
• Microsoft.Exchange.AddressBook.Service.exe
• Microsoft.Exchange.AntispamUpdateSvc.exe
• Microsoft.Exchange.ContentFilter.Wrapper.exe
• Microsoft.Exchange.EdgeSyncSvc.exe
• Microsoft.Exchange.ProtectedServiceHost.exe
• Microsoft.Exchange.RpcClientAccess.Service.exe
• Microsoft.Exchange.Search.ExSearch.exe
• Microsoft.Exchange.ServiceHost.exe
• Microsoft.Office.Project.Server.Calculation.exe
• Microsoft.Office.Project.Server.Eventing.exe
• Microsoft.Office.Project.Server.Queuing.exe
• Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe
• Microsoft.VisualStudio.Web.Host.exe
• mmc.exe
• MMRHookService.exe
• MOM.exe ← Terminates the specified process and any child processes which were started by it.
• mongod.exe
• monitor.exe
• MotionBoard57.exe
• MotionBoardRCService57.exe
• mpdwsvc.exe
• MPService.exe
• mqsvc.exe
• msdtc.exe
• MsDtsSrvr.exe
• MsExchangeFDS.exe
• MSExchangeMailboxAssistants.exe
• MSExchangeMailboxReplication.exe
• MSExchangeMailSubmission.exe
• msexchangerepl.exe
• MSExchangeThrottling.exe
• MSExchangeTransport.exe
• MSExchangeTransportLogSearch.exe
• msftesql.exe
• msmdsrv.exe
• mssearch.exe
• MtxHotPlugService.exe
• Mysoft.Config.WindowsService.exe
• Mysoft.DataCenterService.DataCleaning.exe
• Mysoft.DataCenterService.DataTracking.exe
• Mysoft.DataCenterService.WindowsHost.exe
• Mysoft.SchedulingService.ExecuteEngine.exe
• Mysoft.SchedulingService.WindowsHost.exe
• Mysoft.Setup.InstallService.exe
• Mysoft.UpgradeService.Dispatcher.exe
• Mysoft.UpgradeService.UpdateService.exe
• mysql.exe
• mysqld.exe
• mysqld-nt.exe
• MySQLInstallerConsole.exe
• MySQLNotifier.exe
• navicat.exe
• Net.Service.exe
• NetDiskServer.exe
• NewFileTime_x64.exe
• NFVPrint.exe
• nginx.exe
• nmesrvc.exe
• node.exe
• noderunner.exe
• notepad.exe
• notepad++.exe
• NotificationService.exe
• NovelSpider.exe
• NscAuth.exe
• NscAuthService.exe
• ntpsvr-2019-01-22-no-usrcheck.exe
• ntpsvr-2019-01-22-wgs84.exe
• NtripCaster-2019-01-08.exe
• Nuoadehgcgcd.exe
• Nuoadfaggcje.exe
• OcsAppServerHost.exe
• OfficeClickToRun.exe
• OfficeDaemon.exe
• OfficeIm.exe
• OfficeIndex.exe
• OfficeMail.exe
• OfficePOP3.exe
• OfficeTask.exe
• OfficeUpdate.exe
• omtsreco.exe
• OneDrive.exe
• Oobe.exe
• OPCClient.exe
• OpenFastAssist.exe
• oracle.exe
• oravssw.exe
• OUTLOOK.EXE
• OWSTIMER.EXE
• PalmInputGuard.exe
• PalmInputService.exe
• pcas.exe
• pdfServer.exe
• pdfspeedup.exe
• PerfWatson2.exe
• perl.exe
• PersonUDisk.exe
• php.exe
• php-cgi.exe
• phpStudy.exe
• Pic_2345Svc.exe
• picpick.exe
• ping.exe
• plsqldev.exe
• pnopagw.exe
• PopBlock.exe
• Portal.exe ← Terminates the specified process and any child processes which were started by it.
• postgres.exe
• PresentationFontCache.exe
• PrivacyIconClient.exe
• ProLiantMonitor.exe
• protect.exe
• Protect_2345Explorer.exe
• pvlsvr.exe
• pvxcom.exe
• pvxiosvr.exe
• pvxwin32.exe
• pvxwin64.exe
• qemu-ga.exe
• QmsSvc.exe
• QQ.exe
• QQPCRTP.exe
• QQPCSoftTrayTips.exe
• QQprotect.exe
• QQYService.exe
• QyFragment.exe
• QyKernel.exe
• RaAutoInstSrv.exe
• RaRegistry.exe
• RAVBg64.exe
• RAVCp164.exe
• RAVCpl64.exe
• RavTray.exe
• rcrelay.exe
• rdm.exe
• redis-server.exe
• RefundOrder.exe
• remote.exe
• RemoteAssistProcess.exe
• RemoteExecService.exe
• ReplicaReplicatorAgent.exe
• ReportingServicesService.exe
• RsTray.exe
• RtcCdr.exe
• RTCSrv.exe
• RtHDVCpl.exe
• RtkAudioService64.exe
• rtkjob-ion.exe
• RtkNGUI64.exe
• RtWlan.exe
• RunGate.exe
• Sage.NA.AT_AU.Service.exe
• Sage.NA.AT_AU.SysTray.exe
• SageCSClient.exe
• SAP Business One.exe
• ScanFileServer.exe
• ScanFrm.exe
• schedengine.exe
• Scheduler.exe
• scktsrvr.exe
• secbizsrv.exe
• SecureCRT.exe
• SecureCRTPortable.exe
• SelGate.exe
• server.exe
• ServerManager.exe
• ServerManagerLauncher.exe
• ServerNT.exe
• servers.exe
• service.exe
• service_agent.exe
• Service_KMS.exe
• ServiceHub.DataWarehouseHost.exe
• ServiceHub.Host.CLR.x86.exe
• ServiceHub.Host.Node.x86.exe
• ServiceHub.IdentityHost.exe
• ServiceHub.RoslynCodeAnalysisService32.exe
• ServiceHub.SettingsHost.exe
• ServiceHub.VSDetouredHost.exe
• ServiceMonitor.exe
• Serv-U.exe
• ServUAdmin.exe
• ServUDaemon.exe
• Serv-U-Tray.exe
• sesvc.exe
• setup.exe
• setup100.exe
• sfavsvc.exe
• sfupdatemgr.exe
• SGTool.exe
• ShellStub.exe
• SoftMemory.exe
• SoftMgrLite.exe
• SogouImeBroker.exe
• SohuNews.exe
• SOUNDMAN.exe
• spg_ctl.exe
• splwow64.exe
• SpusCss.exe
• sqlagentc.exe
• SqlBak.Service.exe
• sqlbrowser.exe
• sqlceip.exe
• SQLEXPRWT.exe
• SqlManagement.exe
• sqlmangr.exe
• sqlservr.exe
• sqlwriter.exe
• srvany.exe
• ssclient.exe
• sshd.exe
• Ssms.exe
• store.exe
• SufAppServer.exe
• SunloginClient.exe
• SupportAssistAgent.exe
• SyncBaseConsole.exe
• SyncBaseSvr.exe
• Syslogd_Service.exe
• sysproxy-cmd.exe
• SystemTray64.exe
• TaskService.exe
• TbossGate.exe
• TeamViewer.exe
• TeamViewer_Service.exe
• Tencentdll.exe
• TenpayServer.exe
• Thunder.exe
• ThunderPlatform.exe
• TianHeng.exe
• TimingGenerate.exe
• Tinuknx.exe
• TNSLSNR.exe
• tomcat5.exe
• tomcat7.exe
• Tomcat7w.exe
• tomcat8.exe
• tomcat9.exe
• TongBackupSrv.exe
• TrackingSrv.exe
• TransMain.exe
• TrustCA.exe
• TsServer.exe
• TsService.exe
• TSVNCache.exe
• tv_w32.exe
• tv_x64.exe
• TXPlatform.exe
• U8AllAuthServer.exe
• U8CEServer.exe
• U8DispatchService.exe
• U8KeyManagePool.exe
• U8MPool.exe
• U8SCMPool.exe
• U8SmartClient.exe
• U8SmartClientMonitor.exe
• U8SMSSrv.exe ← Terminates the specified process and any child processes which were started by it.
• U8TaskService.exe
• U8TaskWorker.exe
• U8UpLoadTask.exe
• U8WebPool.exe
• U8WorkerService.exe
• UBFdevenv.exe
• Ufida.T.SM.PublishService.exe ← Terminates the specified process and any child processes which were started by it.
• UFIDA.U8.ECE.UTU.exe
• UFIDA.U8.ECE.UTU.Services.exe
• UFIDA.U8.Report.SLReportService.exe
• UFIDA.U8.UAP.ReportService.exe
• UFIDA.U9.CS.Collaboration.MailService.exe
• UFIDA.U9.SystemManage.SystemManagerClient.exe
• UFIDA.UBF.SystemManage.ApplicationService.exe
• UFMsgCenterService.exe
• UFSoft.U8.Framework.EncryptManager.exe
• UFSoft.U8.OC.QuartzScheduler.exe
• UfSvrMgr.exe ← Terminates the specified process and any child processes which were started by it.
• UfSysHostingService.exe
• UI0Detect.exe
• UIODetect.exe
• update0.exe
• UpdateData.exe
• UpdateGate.exe
• UpdateServer.exe
• usbrdsrv.exe
• usbserver.exe
• UserClient.exe
• usysdiag.exe
• UtilDev.WebServer.Monitor.exe
• UUDesktop.exe
• uvpmonitor.exe ← Terminates the specified process and any child processes which were started by it.
• UVPUpgradeService.exe ← Terminates the specified process and any child processes which were started by it.
• UWS.AppHost.Clr2.AnyCpu.exe
• UWS.AppHost.Clr2.x86.exe
• UWS.HighPrivilegeUtilities.exe
• UWS.LowPrivilegeUtilities.exe
• VBoxSDS.exe
• VBoxSVC.exe
• Veeam.Backup.Agent.ConfigurationService.exe
• Veeam.Backup.BrokerService.exe
• Veeam.Backup.CatalogDataService.exe
• Veeam.Backup.CloudService.exe
• Veeam.Backup.Manager.exe
• Veeam.Backup.MountService.exe
• Veeam.Backup.Service.exe
• veeam.backup.shell.exe
• Veeam.Backup.WmiServer.exe
• Veeam.Guest.Interaction.Proxy.exe
• VeeamDeploymentSvc.exe
• VeeamNFSSvc.exe
• VeeamTransportSvc.exe
• VGAuthService.exe
• VirtualBox.exe
• VirtualBoxVM.exe
• VisualSVNServer.exe
• vm-agent.exe
• vm-agent-daemon.exe
• vmconnect.exe
• vmtoolsd.exe
• vm-tray.exe
• vmware.exe
• vmware-converter.exe
• vmware-converter-a.exe
• VMwareTray.exe
• vmware-tray.exe
• vmware-unity-helper.exe
• vmware-vmrc.exe
• vmware-vmx.exe
• VpxClient.exe
• VS_TrueCorsManager.exe
• vsjitdebugger.exe
• VSSVC.exe
• w3wp.exe
• wampmanager.exe
• WebApi.Host.exe
• WebServer.exe
• WeChat.exe
• winguard_x64.exe
• WINWORD.EXE
• wordpad.exe
• wrapper.exe
• WSSADMIN.EXE
• wsstracing.exe
• wsusservice.exe
• wtautoreg.exe
• wwbizsrv.exe
• XAssistant.exe
• Xshell.exe
• XshellCore.exe
• XT.exe
• XTService.exe
• XXTClient.exe
• XYNTService.exe
• YNoteCefRender.exe
• yonyou.u8.gc.taskmanager.servicebus.exe
• YoudaoNote.exe
• yundetectservice.exe
• zabbix_agentd.exe
• ZTEFileTranS.exe
• ZTEUsbIpc.exe
• ZTEUsbIpcGuard.exe
• ZTEVdservice.exe

ダウンロード活動

マルウェアは、以下のWebサイトにアクセスして自身のコンポーネントファイルをダウンロードします。

• https://{BLOCKED}s.io/QWEwqdsvsf/ap.php

情報漏えい

マルウェアは、以下のパラメータを受け取ります。

• -l
• -d
• -p
• -path {path to encrypt} → encrypts specific path inputted on the command-line.

マルウェアは、以下の情報を収集します。

• User Default Language ID
• Username
• Product Name
• Affected system's IP address
• Processor Architecture

その他

マルウェアは、以下を実行します。

• It encrypts files from local drives, removable drives, and network shares.
• It deletes the following services:
  • 2345PicSvc
  • 360EntClientSvc
  • 360EntHttpServer
  • 360EntSvc
  • abs_deployer
  • ADWS
  • AHS SERVICE
  • AlibabaProtect
  • allpass_redisservice_port21160
  • apachezt
  • AppFabricCachingService
  • asComSvc
  • aspnet_state
  • BackupExecAgentAccelerator
  • BackupExecAgentBrowser
  • BackupExecDeviceMediaService
  • BackupExecJobEngine
  • BackupExecManagementService
  • BackupExecRPCService
  • bedbg
  • BestSyncSvc
  • btPanel
  • c2wts
  • CASLicenceServer
  • cbVSCService11
  • CIS
  • CloudExchangeService
  • CobianBackup10
  • CobianBackup11
  • Daemon Service
  • DAService_TCP
  • EASService
  • EasyFZS Server
  • eCardMPService
  • eCard-TTransServer
  • edr_monitor
  • EnergyDataService
  • ErpEnvSvc
  • eSightService
  • Flash Helper Service
  • FlexNet Licensing Service 64
  • FontCache3.0.0.0
  • FTA
  • ftnlses3
  • ftnlsv3
  • ftusbrdsrv
  • ftusbrdwks
  • FxService
  • Gailun_Downloader
  • GPSDaemon
  • GPSDataProcSvr
  • GPSDownSvr
  • GPSFtpd
  • GPSGatewaySvr
  • GPSLoginSvr
  • GPSMediaSvr
  • GPSMysqld
  • GPSStorageSvr
  • GPSTomcat6
  • GPSUserSvr
  • ImeDictUpdateService
  • IpOverUsbSvc
  • Jenkins
  • jhi_service
  • JhTask
  • K3MobileService
  • kbasesrv
  • KICkSvr
  • Kiwi Syslog Server
  • KMSELDI
  • KuaiYunTools
  • LMS
  • LPManager
  • MASTER
  • MCService
  • MDM
  • MediatekRegistryWriter
  • MMRHookService
  • MotionBoard57
  • MotionBoardRCService57
  • MSCRMAsyncService
  • MSCRMAsyncService$maintenance
  • MSCRMUnzipService
  • MSDTC
  • MsDtsServer100
  • msftesql
  • MSMQ
  • MSSEARCH
  • MSSQL$SQL2008
  • MSSQLFDLauncher
  • MSSQLSERVER
  • MSSQLServerOLAPService
  • Mysoft.Autoupgrade.DispatchService
  • Mysoft.Autoupgrade.UpdateService
  • Mysoft.Config.WindowsService
  • Mysoft.DataCenterService
  • Mysoft.SchedulingService
  • Mysoft.Setup.InstallService
  • MysoftUpdate
  • NFWebServer
  • NscAuthService
  • Nuo Update Monitor
  • OfficeClearCache
  • OfficeUpdateService
  • OpenFastAssist
  • OpenSSHd
  • OracleDBConcoleorcl
  • OracleJobSchedulerORCL
  • OracleMTSRecoveryService
  • OracleOraDb11g_home1ClrAgent
  • OracleOraDb11g_home1TNSListener
  • OracleRemExecService
  • OracleServiceORCL
  • OracleVssWriterORCL
  • OSearch16
  • OSP Service
  • ProjectCalcService16
  • ProjectEventService16
  • ProjectQueueService16
  • Protect_2345Explorer
  • QcSoftService
  • qemu-ga
  • QQCertificateService
  • RaAutoInstSrv_RT2870
  • RabbitMQ
  • RemoteAssistService
  • Redis
  • REPLICA
  • ReportServer
  • ReportServer$SQLEXPRESS
  • Rpc Monitor
  • RTCASMCU
  • RTCATS
  • RTCAVMCU
  • RTCCDR
  • RTCDATAMCU
  • RTCIMMCU
  • RTCMEETINGMCU
  • RtcQms
  • RtcSrv
  • savsvc
  • secbizsrv
  • semwebsrv
  • Sense Shield Service
  • Serv-U
  • ShareBoxMonitorService
  • ShareBoxService
  • SiebelApplicationContainer_Siebel_Home_d_Siebel_sai
  • smtpsvrJT
  • SPAdminV4
  • SPSearchHostController
  • SPTimerV4
  • SPTraceV4
  • SQL Server Reporting Services
  • SQLAgent$SQL2008
  • SQLANYs_sem5
  • SQLBrowser
  • SQLSERVERAGENT
  • SQLService
  • SQLTELEMETRY
  • SQLWriter
  • SSMonitorService
  • SSSyncService
  • SyncBASE Service
  • TbossSystem
  • TCPIDDAService
  • TeamViewer
  • TongBackupSrv
  • TPlusStdAppService1300
  • TPlusStdTaskService1300
  • TPlusStdUpgradeService1300
  • TurboCRM70
  • TxQBService
  • U8DispatchService
  • U8EISService
  • U8EncryptService
  • U8GCService
  • U8KeyManagePool
  • U8MPool
  • U8SCMPool
  • U8SLReportService
  • U8SmsSrv
  • U8TaskService
  • U8WebPool
  • U8WorkerService1
  • U8WorkerService2
  • UFAllNet
  • UFReportService
  • UI0Detect
  • UIODetect
  • UtilDev Web Server Pro
  • UTUService
  • UWS HiPriv Services
  • UWS LoPriv Services
  • VGAuthService
  • VirboxWebServer
  • VisualSVNServer
  • vm-agent
  • VmAgentDaemon
  • VMAuthdService
  • VMTools
  • VMUSBArbService
  • vmware-converter-agent
  • vmware-converter-server
  • vmware-converter-worker
  • VMwareHostd
  • vsvnjobsvc
  • wampapache
  • wanxiao-monitor
  • WebAttendServer
  • wwbizsrv
  • XT800Service_Personal
  • YunService
  • Zabbix Agent
  • ZTE FileTranS
  • ZTE USBIP Client
  • ZTE USBIP Client Guard
  • ZTEVdservice
  • zyb_sync
• It blocks any system shutdown and displays the following the message:
  • "Do NOT shutdown OR reboot your PC: this might damage your files permanently !"
• It reverts the following modified registries entries back to its default values after encryption:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Policies\System\shutdownwithoutlogon
• Base on analysis of the codes, this malware has the following capabilities:
  • Drops a copy of itself in the %Windows% directory and names it as "mallox.exe"
  • Creates and starts a service named "mallox" that executes the copy of itself in the %Windows% directory

(註：%Windows%フォルダは、Windowsが利用するフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows" です。.)

ランサムウェアの不正活動

以下の拡張子を持つファイルを暗号化します：$$ DATA $$

• .7z
• .bak
• .dbf
• .dmp
• .gz
• .hdd
• .ibd
• .lck
• .mdb
• .mdb
• .mdf
• .nvram
• .ora
• .oraenv
• .rar
• .smd
• .sql
• .vdi
• .vhd
• .vhd
• .vhdx
• .vmdk
• .vmem
• .vmsd
• .vmsn
• .vmss
• .vmx
• .zip

マルウェアは、ファイル名に以下の文字列を含むファイルの暗号化はしません。

• autorun.inf
• boot.ini
• bootfont.bin
• bootsect.bak
• debugLog.txt
• desktop.ini
• iconcache.db
• ntldr
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• TargetInfo.txt
• thumbs.db

マルウェアは、ファイルパスに以下の文字列を含むファイルの暗号化はしません。

• $windows.~bt
• $windows.~ws
• appdata
• applicationdata
• Assemblies
• boot
• CommonFiles
• CoreRuntime
• fdhost.exe
• fdlauncher.exe
• google
• intel
• InternetExplorer
• Microsoft.NET
• MicrosoftAnalysisServices
• MicrosoftASP.NET
• MicrosoftHelpViewer
• MicrosoftMPI
• MicrosoftSecurityClient
• mozilla
• MsDtsSrvr.exe
• msmdsrv.exe
• msocache
• mysql.exe
• ntdbsmgr.exe
• oracle.exe
• Package
• PackageStore
• perflogs
• programdata
• Reference
• ReportingServecesService.exe
• sqlserv.exe
• sqlservr.exe
• sqlwriter.exe
• Store
• systemvolumeinformation
• torbrowser
• Windows
• windows.old
• WindowsDefender
• WindowsKits
• WindowsMail
• WindowsMicrosoft.NET
• WindowsNT
• WindowsPhotoViewer
• WindowsPortableDevices
• WindowsPowerShell
• WindowsSidebar

マルウェアは、暗号化されたファイルのファイル名に以下の拡張子を追加します。

• .xollam

マルウェアが作成する以下のファイルは、脅迫状です。

• {All Available Folders}\FILE RECOVERY.txt
  

以下のファイル拡張子を持つファイルについては暗号化しません：

• .386
• .adv
• .ani
• .bak
• .bat
• .bin
• .cab
• .cmd
• .com
• .cpl
• .cur
• .dbf
• .deskthemepack
• .diagcfg
• .diagpkg
• .diangcab
• .dll
• .drv
• .exe
• .Globeimposter-Alpha666qqz
• .Globeimposter-Alpha865qqz
• .hlp
• .hta
• .icl
• .icns
• .ico
• .ics
• .idx
• .key
• .lnk
• .lock
• .mallox
• .mdb
• .mdf
• .mod
• .mpa
• .msc
• .msi
• .msp
• .msstyles
• .msu
• .nls
• .nomedia
• .ocx
• .prf
• .ps1
• .rom
• .rtp
• .scr
• .shs
• .smd
• .spl
• .sql
• .sys
• .theme
• .themepack
• .wpx
• .xollam