RANSOM_FAKECERBER.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Application Data%\index.html

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• {Current Malware Directory}\{Random Characters}.exe
• %Application Data%\index.bat --> used to execute the malware

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Ransomware modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = %Application Data%\index.bat

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Class\{GUID}
LowerFilters = "XXX"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Class\{GUID}
UpperFilters = "XXX"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\RemovableStorageDevices
Deny_all = "1"

It adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMg = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

Other Details

This Ransomware does the following:

• It deletes shadow copies by executing the following command:
  
  • /C vssadmin Delete Shadows /All /Quiet
  • /C wmic shadowcopy delete
  • /C Bcdedit.exe /set {default} recoveryenabled no
  • /C Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• It executes the following command to restart the affected machine:
  
  • shutdown -r -f -t 0
• After restarting it displays the following ransom screen:
  
  • 
• This ransomware does not encrypt files.