Ransom.Win32.STOP.GE

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %System Root%\SystemID\PersonalID.txt
• %ProgramData%\{Random Numbers} → Delete Afterwards
• %AppDataLocal%\bowsakkdestx.txt → Delete Afterwards
• %Temporary Internet Files%\Content.IE5\YEFGVF95\build2.exe → Delete Afterwards
• %Temporary Internet Files%\Content.IE5\YEFGVF95\116_203_9_69.txt

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• icalcs "%AppDataLocal%\{GUID}" /deny *S-1-1-0:(OI)(CI)(DE,DC)
• %AppDataLocal%\{GUID}\build2.exe
• %AppDataLocal%\{GUID}\build3.exe
• %System%\cmd.exe" /c timeout /t 6 & del /f /q "%AppDataLocal%\{GUID}build2.exe" & exit

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SysHelper = %AppDataLocal%\{GUID}\{Malware Filename}.exe" --AutoStart

Download Routine

This Ransomware accesses the following websites to download files:

• http://{BLOCKED}.{BLOCKED}.9.69/get.zip
• http://{BLOCKED}is.com/test1/get.php?pid={hash}&first=true
• http://{BLOCKED}y.top/dl/build2.exe$run
• http://{BLOCKED}is.com/files/1/build3.exe$run
• http://{BLOCKED}.{BLOCKED}.9.69/19

It saves the files it downloads using the following names:

• %AppDataLocal%\{GUID}\build2.exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Ransomware gathers the following data:

• IP Address
• MAC Address
• Computer Name
• User Name

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• https://{BLOCKED}i.{BLOCKED}p.ua/geo.json
  • It terminates and deletes itself on the affected system if the return of the IP address location is any of the following:
  • RU (Russia)
  • BY (Belarus)
  • UA (Ukraine)
  • AZ (Azerbaijan)
  • AM (Armenia)
  • TJ (Tajikistan)
  • KZ (Kazakhstan)
  • KG (Kyrgyzstan)
  • UZ (Uzbekistan)
  • SY (Syrian Arab Republic)

It accepts the following parameters:

• --Admin → runs the malware as admin
• --AutoStart → executes using autorun registry keys
• IsAutoStart/IsNotAutoStart → executes malware as an autostart or not
• IsTask/IsNotTask → executes malware as a task or not
• --ForNetRes {argument/s from URL}
• --Service {PID of parent malware} {argument/s from URL}

It adds the following scheduled tasks:

• Task Name: Time Trigger Task
• Task Action: %AppDataLocal%\{GUID}\{Malware Filename}.exe --Task

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware renames encrypted files using the following names:

• {Original Filename}.{Original Extension}.zoqw

It drops the following file(s) as ransom note:

• {Encrypted Directory}\_readme.txt