Ransom.MSIL.WANNASCREAM.C

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %System%\cmd.exe /c vssadmin.exe delete shadows /all /quiet

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Ransomware drops the following file(s) in the Windows Startup folder to enable its automatic execution at every system startup:

• %User Startup%\winlogon.exe → Copy of Itself
• %User Startup%\info.hta → Detected as Ransom.MSIL.WANNASCREAM.C.note

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Backdoor Routine

This Ransomware connects to the following websites to send and receive information:

• http://recoverydata.{BLOCKED}sting.com/db

Information Theft

This Ransomware gathers the following data:

• Operating System
• CPU information
• Public IP Address
• Total Size of All Logical Drives
• Machine Name
• Volume Serial Number
• Processor ID

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• ReadMe.txt
• info.hta
• BOOTNXT
• bootmgr
• BOOTSECT.BAK
• boot.sdi
• ReAgent.xml
• Winre.wim
• BOOTSTAT.DAT
• C:\Windows

It appends the following extension to the file name of the encrypted files:

• .[{Generated ID from Volume Serial ID or Processor ID}[decryptfile25@protonmail.com].Fob

It drops the following file(s) as ransom note:

• {Encrypted Directory}\info.hta
  
• {Encrypted Directory}\ReadMe.txt
  

It avoids encrypting files with the following file extensions:

• .Fob