Ransom.Win32.FAKEGLOBE.MRW

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %System Root%\{random values}.tmp.bat → contains commands to delete shadow copies, add and delete registry keys, and delete a file

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

• %Application Data%\{Malware Name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
CertificatesCheck = %Application Data%\{Malware Name}.exe

Other System Modifications

This Ransomware deletes the following files:

• %User Profile%\Documents\Default.rdp

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Default

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers

Process Termination

This Ransomware terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• outlook
• ssms
• postgre
• excel
• word

Other Details

This Ransomware does the following:

• It avoids encrypting files with the following extensions:
  • .$er
  • .4db
  • .4dd
  • .4mp
  • .abs
  • .abx
  • .accdb
  • .accdc
  • .accde
  • .accdr
  • .accdt
  • .accdw
  • .accft
  • .adn
  • .adp
  • .aft
  • .ahd
  • .alf
  • .ask
  • .awdb
  • .azz
  • .bdb
  • .bib
  • .bnd
  • .bok
  • .btr
  • .cdb
  • .cdb
  • .cdb
  • .ckp
  • .clkw
  • .cma
  • .crd
  • .daconnections
  • .dacpac
  • .dad
  • .dadiagrams
  • .daf
  • .daschema
  • .db-shm
  • .db-wa
  • .db2
  • .db3
  • .dbc
  • .dbf
  • .dbf
  • .dbk
  • .dbs
  • .dbt
  • .dbv
  • .dbx
  • .dcb
  • .dct
  • .dcx
  • .df1
  • .dmo
  • .dnc
  • .dp1
  • .dqy
  • .dsk
  • .dsn
  • .dta
  • .dtsx
  • .eco
  • .ecx
  • .edb
  • .emd
  • .fcd
  • .fdb
  • .fic
  • .fid
  • .fm5
  • .fmp
  • .fmp12
  • .fmps
  • .fp3
  • .fp4
  • .fp5
  • .fp7
  • .fpt
  • .fzb
  • .fzv
  • .gdb
  • .gwi
  • .hdb
  • .his
  • .idc
  • .ihx
  • .itdb
  • .itw
  • .jtx
  • .kdb
  • .lgc
  • .maq
  • .mdb
  • .mdbhtm
  • .mdf
  • .mdn
  • .mdt
  • .mrg
  • .mud
  • .mwb
  • .myd
  • .ndf
  • .ns2
  • .ns3
  • .ns4
  • .nsf
  • .nv2
  • .nyf
  • .oce
  • .odb
  • .oqy
  • .ora
  • .orx
  • .owc
  • .owg
  • .oyx
  • .p96
  • .p97
  • .pan
  • .pdb
  • .pdm
  • .phm
  • .pnz
  • .pth
  • .pwa
  • .qpx
  • .qry
  • .qvd
  • .rctd
  • .rdb
  • .rpd
  • .rsd
  • .sbf
  • .sdb
  • .sdf
  • .spq
  • .sqb
  • .sqlite
  • .sqlite3
  • .sqlitedb
  • .str
  • .tcx
  • .tdt
  • .teacher
  • .tmd
  • .trm
  • .udb
  • .usr
  • .v12
  • .vdb
  • .vpd
  • .wdb
  • .wmdb
  • .xdb
  • .xld
  • .xlgc
  • .zdb
• It deletes all shadow copies using the following command:
  • vssadmin.exe Delete Shadows /All /Quiet

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• Windows
• Microsoft
• Microsoft Help
• Windows App Certification Kit
• Windows Defender
• ESET
• COMODO
• Windows NT
• Windows Kits
• Windows Mail
• Windows Media Player
• Windows Multimedia Platform
• Windows Phone Kits
• Windows Phone Silverlight Kits
• Windows Photo Viewer
• Windows Portable Devices
• Windows Sidebar
• WindowsPowerShell
• NVIDIA Corporation
• Microsoft.NET
• Internet Explorer
• Kaspersky Lab
• McAfee
• Avira
• spytech software
• sysconfig
• Avast
• Dr.Web
• Symantec
• Symantec_Client_Security
• system volume information
• Microsoft Shared
• Common Files
• Outlook Express
• Movie Maker
• Chrome
• Mozilla Firefox
• Opera
• YandexBrowser
• ntldr
• Wsus
• ProgramData

It renames encrypted files using the following names:

• {file name}.{file extension}.crypted_uridzu@{BLOCKED}ts3as_com

It drops the following file(s) as ransom note:

• {Encrypted Folder}\how_to_back_files.html