RANSOM_ACKNYS.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops and executes the following files:

• %Application Data%\msiexec.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It executes then deletes itself afterward.

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
LegalNoticeCaption = "SynAck FES"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
LegalNoticeText = "Hello. Your files are encrypted. To restore files, please contac t us by e-mail: synack@{BLOCKED}mail.com or synack@{BLOCKED}rmail.com."

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• conime.exe
• excel.exe
• fdhost.exe
• httpd.exe
• ilsvc.exe
• javaw.exe
• lua.exe
• lync.exe
• melsc.exe
• memis.exe
• memta.exe
• memtas
• mepoc.exe
• mepocs
• mepopc.exe
• metray.exe
• mmc.exe
• monad.exe
• mqsvc.exe
• msoia.exe
• mysql
• mysqld.exe
• named.exe
• nssm.exe
• php.exe
• python.exe
• qbvss
• qbw32.exe
• sesvc
• skype.exe
• srvany.exe
• ssms.exe
• steam.exe
• store.exe
• tabtip.exe
• vds.exe
• vksts.exe
• vmvss
• vssvc.exe
• w3svc
• w3wp.exe
• wmsvc

Dropping Routine

This Ransomware drops the following files:

• {Encrypted Folder}\==READ==THIS==PLEASE=={Hex values}.txt

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• http://ipinfo.io

It does the following:

• It encrypts all files except for the following files having the following extensions:
  • .cnt
  • .tmp
  • .log
  • .exe
  • .dll
  • .lnk
  • .mui
  • .sys
  • .msi
  • .bak
  • .com
• It encrypts files in fixed, removable and network drives.
• It does not proceed to its malicious routine if detected that it has the following languages in the keyboard layout:
  • Armenian
  • Azerbaijani Cyrillic
  • Belorussian
  • Georgian
  • Kazakhztan
  • Russian
  • Tajik
  • Ukrainian
  • Uzbek Cyrillic
  • Uzbek Latin
• It requires a specific folder in order for it to proceed to its malicious routine.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• {File Name}{File Extension}.{Random 10 Characters}

It drops the following file(s) as ransom note: