Ransom.BAT.TARGETCOMP.THBBGBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\xl1ynand.thf.ps1
• %User Temp%\wemuhj25.xp2.psm1
• %AppDataLocal%\Microsoft\Windows\PowerShell\ModuleAnalysisCache
• %User Temp%\Bwmeldokiller.bat
• %User Temp%\cydurk4o.fpq.ps1
• %User Temp%\jkixckve.qvo.psm1
• %AppDataLocal%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• attrib +s +h "%User Temp%\{random strings}.tmp\{file name}.bat".exe
• %User Temp%\{random strings}.tmp\{file name}.bat".exe -wIn 1 -enC {encrypted command}
• "%System%\WindowsPowerShell\v1.0\powershell.exe" -ENC {encrypted command} ← start-sleep -seconds 20
• %User Temp%\Bwmeldokiller.bat
• %Windows%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
• cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
• %Windows%\sysnative\vssadmin.exe delete shadows /all /quiet
• cmd.exe /c bcdedit /set {current} recoveryenabled no

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It creates the following folders:

• %User Temp%\{random strings}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0

Propagation

This Ransomware uses the following file names for the copies it drops into shared networks:

• mallox.exe

Process Termination

This Ransomware terminates the following services if found on the affected system:

• 360EntPGSvc
• ABBYY.Licensing.FineReader.Professional.12.0
• AdobeARMservice
• AgentX
• AGSService
• Alibaba Security Aegis Detect Service
• Alibaba Security Aegis Update Service
• AliyunService
• AngelOfDeath
• Apache2.2
• Apache2.4
• Apple Mobile Device Service
• AutoUpdatePatchService
• AutoUpdateService
• Bonjour Service
• CASLicenceServer
• CASMsgSrv
• CASVirtualDiskService
• CASWebServer
• CASXMLService
• cbVSCService
• ceng_web_svc_d
• ClickToRunSvc
• CobianBackup10
• d_safe
• DDNSService
• DDVRulesProcessor
• Dell Hardware Support
• DellDRLogSvc
• DFServ
• DGPNPSEV
• EvtSys
• FileZilla Server
• FirebirdGuardianDeafaultInstance
• FirebirdServerDefaultInstance
• GNWebService
• HaoZipSvc
• igfxCUIService2.0.0.0
• ImtsEventSvr
• iNethinkSQLBackupSvc
• IngressMgr
• JWEM3DBAUTORun
• JWRinfoClientService
• JWService
• K3ClouManager
• K3MMainSuspendService
• K3MobileServiceManage
• KpService
• KugouService
• memcached Server
• MSComplianceAudit
• MsDtsServer100
• MsDtsServer130
• MSExchangeADTopology
• MSExchangeAntispamUpdate
• MSExchangeCompliance
• MSExchangeDagMgmt
• MSExchangeDelivery
• MSExchangeDiagnostics
• MSExchangeEdgeSync
• MSExchangeFastSearch
• MSExchangeFrontEndTransport
• MSExchangeHM
• MSExchangeHMRecovery
• MSExchangeImap4
• MSExchangeIMAP4BE
• MSExchangeIS
• MSExchangeMailboxAssistants
• MSExchangeMailboxReplication
• MSExchangeNotificationsBroker
• MSExchangePop3
• MSExchangePOP3BE
• MSExchangeRepl
• MSExchangeRPC
• MSExchangeServiceHost
• MSExchangeSubmission
• MSExchangeThrottling
• MSExchangeTransport
• MSExchangeTransportLogSearch
• MSExchangeUM
• MSExchangeUMCR
• msftesql$SQLEXPRESS
• MSOLAP$SHOPCONTROL9
• MSSQL
• MSSQL$FE_EXPRESS
• MSSQL$OPTIMA
• MSSQL$PROGID
• MSSQL$SHOPCONTROL9
• MSSQL$SQL2008
• MSSQL$VEEAMSQL2012
• MSSQL$WOLTERSKLUWER
• MSSQLFDLauncher
• MSSQLFDLauncher$OPTIMA
• MSSQLFDLauncher$SHOPCONTROL9
• MSSQLServerADHelper100
• MSSQLServerOLAPService
• Mysoft.SchedulingService
• MySQL
• MySQL5_OA
• mysqltransport
• NetBackup Client Service
• NetBackup Discovery Framework
• NetBackup Legacy Client Service
• NetBackup Legacy Network Service
• NetBackup Proxy Service
• NetBackup SAN Client Fibre Transport Service
• NetVault Process Manager
• NFLicenceServer
• NFOTPService
• NFSysService
• NFVPrintServer
• OMAILREPORT
• OracleDBConsoleilas
• OracleOraDb10g_homeliSQL*Plus
• pcas
• postgresql-x64-9.4
• QPCore
• RapidRecoveryAgent
• RapService
• RavService
• RavTask
• Realtek11nSU
• ReportServer
• ReportServer$OPTIMA
• ReportServer$SHOPCONTROL9
• RTCAVMCU
• SAP Business One RSP Agent Service
• SAPB1iDIProxy
• SAPB1iDIProxy_Monitor
• SAPB1iEventSender
• SBOClientAgent
• SBODI_Server
• SBOJobServiceBackEnd
• SBOMail
• SBOWFDataAccess
• SBOWorkflowEngine
• SentinelKeysServer
• Service2
• ServiceMid
• SQLAgent
• SQLAgent$OPTIMA
• SQLAgent$PROGID
• SQLAgent$SHOPCONTROL9
• SQLAgent$VEEAMSQL2012
• SQLAgent$WOLTERSKLUWER
• SQLBackupAndFTP Client Service
• SQLBrowser
• SQLSERVERAGENT
• SQLTELEMETRY
• SQLTELEMETRY$HL
• SQLWrite
• SSISTELEMETRY130
• SupportAssistAgent
• Synology Drive VSS Service x64
• TeamViewer
• TeamViewer8
• TMBMServer
• tmlisten
• Tomcat8
• TPlusStdAppService1220
• TPlusStdAppService1300
• TPlusStdTaskService1220
• TPlusStdTaskService1300
• TPlusStdUpgradeService1220
• TPlusStdUpgradeService1300
• TPlusStdWebService1300
• TurboCRM70
• U8DispatchService
• U8EISService
• U8EncryptService
• U8GCService
• U8KeyManagePool
• U8MPool
• U8SCMPool
• U8SendMailAdmin
• U8SLReportService
• U8TaskService
• U8WebPool
• U8WorkerService1
• U8WorkerService2
• UFAllNet
• UFIDAWebService
• UFNet
• UFReportService
• UIODetect
• UTUService
• VeeamBrokerSvc
• VeeamCatalogSvc
• VeeamCloudSvc
• VeeamDeploySvc
• VeeamDistributionSvc
• VeeamMountSvc
• VeeamNFSSvc
• VeeamTransportSvc
• VeeanBackupSvc
• VMAuthdService
• VMnetDHCP
• VMUSBArbService
• VMware NAT Service
• VMwareHostd
• wanxiao-monitor
• WebAttendServer
• xenlite
• XenSvc

It terminates the following processes if found running in the affected system's memory:

• cbInterface.exe
• cbService.exe
• cbVSCService11.exe
• Cobian.exe
• DataCollectorSvc.exe
• dbsrv12.exe
• DDSoftPwsTomcat9.exe
• EdgeTransport.exe
• EXCEL.EXE
• fdhost.exe
• fdlauncher.exe
• FileZilla Server.exe
• Kingdee.K3.CRM.MMC.AutoService.exe
• Launchpad.exe
• licenceserver.exe
• MessageNotification.exe
• Microsoft.Exchange.AddressBook.Service.exe
• Microsoft.Exchange.AntispamUpdateSvc.exe
• Microsoft.Exchange.ContentFilter.Wrapper.exe
• Microsoft.Exchange.EdgeSyncSvc.exe
• Microsoft.Exchange.ProtectedServiceHost.exe
• Microsoft.Exchange.RpcClientAccess.Service.exe
• Microsoft.Exchange.Search.ExSearch.exe
• Microsoft.Exchange.ServiceHost.exe
• Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe
• mpdwsvc.exe
• MsDtsSrvr.exe
• MsExchangeFDS.exe
• MSExchangeMailboxAssistants.exe
• MSExchangeMailboxReplication.exe
• MSExchangeMailSubmission.exe
• msexchangerepl.exe
• MSExchangeThrottling.exe
• MSExchangeTransport.exe
• MSExchangeTransportLogSearch.exe
• msmdsrv.exe
• mysql.exe
• mysqld-nt.exe
• mysqld.exe
• NFVPrint.exe
• OneDrive.exe
• OUTLOOK.EXE
• pvxcom.exe
• pvxiosvr.exe
• pvxwin32.exe
• pvxwin64.exe
• ReportingServicesService.exe
• Sage.NA.AT_AU.Service.exe
• Sage.NA.AT_AU.SysTray.exe
• SageCSClient.exe
• SAP Business One.exe
• ServerNT.exe
• sqlagentc.exe
• SqlBak.Service.exe
• sqlbrowser.exe
• sqlceip.exe
• SqlManagement.exe
• sqlservr.exe
• sqlwriter.exe
• Ssms.exe
• store.exe
• TaskService.exe
• Tomcat7w.exe
• tomcat9.exe
• TongBackupSrv.exe
• U8CEServer.exe
• U8SmartClient.exe
• U8SmartClientMonitor.exe
• UFMsgCenterService.exe
• UFSoft.U8.OC.QuartzScheduler.exe
• Veeam.Backup.Agent.ConfigurationService.exe
• Veeam.Backup.BrokerService.exe
• Veeam.Backup.CatalogDataService.exe
• Veeam.Backup.CloudService.exe
• Veeam.Backup.Manager.exe
• Veeam.Backup.MountService.exe
• Veeam.Backup.Service.exe
• Veeam.Backup.WmiServer.exe
• Veeam.Guest.Interaction.Proxy.exe
• VeeamDeploymentSvc.exe
• VeeamNFSSvc.exe
• VeeamTransportSvc.exe
• w3wp.exe
• WINWORD.EXE
• wsusservice.exe

Download Routine

This Ransomware connects to the following URL(s) to download its component file(s):

• https://{BLOCKED}s.io/QWEwqdsvsf/ap.php

Information Theft

This Ransomware gathers the following data:

• Machine ID
• OS Version
• System Locale
• IP Address

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
Wpad = 0a-00-27-00-00-00

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
Wpad = {GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\ESS\//./root
CIMV2 = SCM Event Provider

It connects to the following URL(s) to get the affected system's IP address:

• http://{BLOCKED}ify.org

It does the following:

• It stops and deletes the following services if found on the affected system's memory:
  • 2345PicSvc
  • 360EntClientSvc
  • 360EntHttpServer
  • 360EntSvc
  • abs_deployer
  • ADWS
  • AHS SERVICE
  • AlibabaProtect
  • allpass_redisservice_port21160
  • apachezt
  • AppFabricCachingService
  • asComSvc
  • aspnet_state
  • BackupExecAgentAccelerator
  • BackupExecAgentBrowser
  • BackupExecDeviceMediaService
  • BackupExecJobEngine
  • BackupExecManagementService
  • BackupExecRPCService
  • bedbg
  • BestSyncSvc
  • btPanel
  • c2wts
  • CASLicenceServer
  • cbVSCService11
  • CIS
  • CloudExchangeService
  • CobianBackup10
  • CobianBackup11
  • Daemon Service
  • DAService_TCP
  • EASService
  • EasyFZS Server
  • eCard-TTransServer
  • eCardMPService
  • edr_monitor
  • EnergyDataService
  • ErpEnvSvc
  • eSightService
  • Flash Helper Service
  • FlexNet Licensing Service 64
  • FontCache3.0.0.0
  • FTA
  • ftnlses3
  • ftnlsv3
  • ftusbrdsrv
  • ftusbrdwks
  • FxService
  • Gailun_Downloader
  • GPSDaemon
  • GPSDataProcSvr
  • GPSDownSvr
  • GPSFtpd
  • GPSGatewaySvr
  • GPSLoginSvr
  • GPSMediaSvr
  • GPSMysqld
  • GPSStorageSvr
  • GPSTomcat6
  • GPSUserSvr
  • ImeDictUpdateService
  • IpOverUsbSvc
  • Jenkins
  • jhi_service
  • JhTask
  • K3MobileService
  • kbasesrv
  • KICkSvr
  • Kiwi Syslog Server
  • KMSELDI
  • KuaiYunTools
  • LMS
  • LPManager
  • MASTER
  • MCService
  • MDM
  • MediatekRegistryWriter
  • MMRHookService
  • MotionBoard57
  • MotionBoardRCService57
  • MSCRMAsyncService
  • MSCRMAsyncService$maintenance
  • MSCRMUnzipService
  • MSDTC
  • MsDtsServer100
  • msftesql
  • MSMQ
  • MSSEARCH
  • MSSQL$SQL2008
  • MSSQLFDLauncher
  • MSSQLSERVER
  • MSSQLServerOLAPService
  • Mysoft.Autoupgrade.DispatchService
  • Mysoft.Autoupgrade.UpdateService
  • Mysoft.Config.WindowsService
  • Mysoft.DataCenterService
  • Mysoft.SchedulingService
  • Mysoft.Setup.InstallService
  • MysoftUpdate
  • NFWebServer
  • NscAuthService
  • Nuo Update Monitor
  • OfficeClearCache
  • OfficeUpdateService
  • OpenFastAssist
  • OpenSSHd
  • OracleDBConcoleorcl
  • OracleJobSchedulerORCL
  • OracleMTSRecoveryService
  • OracleOraDb11g_home1ClrAgent
  • OracleOraDb11g_home1TNSListener
  • OracleRemExecService
  • OracleServiceORCL
  • OracleVssWriterORCL
  • OSearch16
  • OSP Service
  • ProjectCalcService16
  • ProjectEventService16
  • ProjectQueueService16
  • Protect_2345Explorer
  • QcSoftService
  • qemu-ga
  • QQCertificateService
  • RaAutoInstSrv_RT2870
  • RabbitMQ
  • Redis
  • RemoteAssistService
  • REPLICA
  • ReportServer
  • ReportServer$SQLEXPRESS
  • Rpc Monitor
  • RTCASMCU
  • RTCATS
  • RTCAVMCU
  • RTCCDR
  • RTCDATAMCU
  • RTCIMMCU
  • RTCMEETINGMCU
  • RtcQms
  • RtcSrv
  • savsvc
  • secbizsrv
  • semwebsrv
  • Sense Shield Service
  • Serv-U
  • ShareBoxMonitorService
  • ShareBoxService
  • SiebelApplicationContainer_Siebel_Home_d_Siebel_sai
  • smtpsvrJT
  • SPAdminV4
  • SPSearchHostController
  • SPTimerV4
  • SPTraceV4
  • SQL Server Reporting Services
  • SQLAgent$SQL2008
  • SQLANYs_sem5
  • SQLBrowser
  • SQLSERVERAGENT
  • SQLService
  • SQLTELEMETRY
  • SQLWriter
  • SSMonitorService
  • SSSyncService
  • SyncBASE Service
  • TbossSystem
  • TCPIDDAService
  • TeamViewer
  • TongBackupSrv
  • TPlusStdAppService1300
  • TPlusStdTaskService1300
  • TPlusStdUpgradeService1300
  • TurboCRM70
  • TxQBService
  • U8DispatchService
  • U8EISService
  • U8EncryptService
  • U8GCService
  • U8KeyManagePool
  • U8MPool
  • U8SCMPool
  • U8SLReportService
  • U8SmsSrv
  • U8TaskService
  • U8WebPool
  • U8WorkerService1
  • U8WorkerService2
  • UFAllNet
  • UFReportService
  • UI0Detect
  • UIODetect
  • UtilDev Web Server Pro
  • UTUService
  • UWS HiPriv Services
  • UWS LoPriv Services
  • VGAuthService
  • VirboxWebServer
  • VisualSVNServer
  • vm-agent
  • VmAgentDaemon
  • VMAuthdService
  • VMTools
  • VMUSBArbService
  • vmware-converter-agent
  • vmware-converter-server
  • vmware-converter-worker
  • VMwareHostd
  • vsvnjobsvc
  • wampapache
  • wanxiao-monitor
  • WebAttendServer
  • wwbizsrv
  • XT800Service_Personal
  • YunService
  • Zabbix Agent
  • ZTE FileTranS
  • ZTE USBIP Client
  • ZTE USBIP Client Guard
  • ZTEVdservice
  • zyb_sync

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .xollam

It drops the following file(s) as ransom note:

• {Affected directories}\FILE RECOVERY.txt