Ransom.Win32.DARKSIDE.FAIO

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %All Users Profile%\{Generated Extension}.ico → Icon for encrypted files.
• %All Users Profile%\{Generated Extension}.BMP → Used as wallpaper.

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It adds the following processes:

• {Malware Directory}\{Malware Filename} -work worker{Number} job{Number}-{4-Digit Number} → For every drive that it will encrypt.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{32-Hex Characters generated from Machine GUID}

Other System Modifications

This Ransomware adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.{Generated Extension}
(Default) = {Generated Extension}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{Generated Extension}\DefaultIcon
(Default) = %All Users Profile%\{Generated Extension}.ico

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_USERS\{USER SID}\Control Panel\
Desktop
Wallpaper = %All Users Profile%\{Generated Extension}.BMP

HKEY_USERS\{USER SID}\Control Panel\
Desktop
WallpaperStyle = 10

It sets the system's desktop wallpaper to the following image:

Process Termination

This Ransomware terminates the following services if found on the affected system:

• vss
• sql
• svc$
• memtas
• mepocs
• sophos
• veeam
• backup
• GxVss
• GxBlr
• GxFWD
• GxCVD
• GxCIMgr

It terminates the following processes if found running in the affected system's memory:

• sql
• oracle
• ocssd
• dbsnmp
• synctime
• agntsvc
• isqlplussvc
• xfssvccon
• mydesktopservice
• ocautoupds
• encsvc
• firefox
• tbirdconfig
• mydesktopqos
• ocomm
• dbeng50
• sqbcoreservice
• excel
• infopath
• msaccess
• mspub
• onenote
• outlook
• powerpnt
• steam
• thebat
• thunderbird
• visio
• winword
• wordpad
• notepad

Information Theft

This Ransomware gathers the following data:

• Username
• Computer Name
• Domain Name
• OS Information (Type, Version, Architecture)
• System Language
• Drives Information (Drive Names, Drive Space)

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• bar{BLOCKED}ees.com

Other Details

This Ransomware adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.{Generated Extension}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{Generated Extension}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{Generated Extension}\DefaultIcon

It does the following:

• It checks computer's language and will terminate itself if any of the following language is detected:
  • Arabic
  • Armenian
  • Azerbaijani
  • Belarusian
  • Georgian
  • Kazakh
  • Kyrgyz
  • Romanian
  • Russian
  • Tajik
  • Tatar
  • Turkmen
  • Ukranian
  • Uzbek
• It checks if it is running with a privilege level that is on SYSTEM level. If it is not, it will do the following:
  • If it is running on a non-administrator account and the os version is Windows 7 or above it will use the Elevated COM Object UAC Bypass technique to execute an instance of itself with SYSTEM level privilege.
  • If it is running on an administrator account it would add the following service then start and use the service to execute an instance of itself with SYSTEM level privilege. The service is deleted after it is used.
    • Service Name: .{Generated Extension}
    • Binary Pathname: {Malware Directory}\{Malware Filename}
• It searches for files to encrypt in fixed drives, removable drives, and network resources.
• It empties the recycle bin.
• It deletes shadow copies.

However, as of this writing, the said sites are inaccessible.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• autorun.inf
• boot.ini
• bootfont.bin
• bootsect.bak
• desktop.ini
• iconcache.db
• ntldr
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• thumbs.db
• README.{Generated Extension}.TXT

It avoids encrypting files with the following strings in their file path:

• $recycle.bin
• config.msi
• $windows.~bt
• $windows.~ws
• windows
• appdata
• application data
• boot
• google
• mozilla
• program files
• program files (x86)
• programdata
• system volume information
• tor browser
• windows.old
• intel
• msocache
• perflogs
• x64dbg
• public
• all users
• default

It appends the following extension to the file name of the encrypted files:

• .{8-Hex Characters generated from Machine GUID}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\README.{Generated Extension}.TXT
  

It avoids encrypting files with the following file extensions:

• .386
• .adv
• .ani
• .bat
• .bin
• .cab
• .cmd
• .com
• .cpl
• .cur
• .deskthemepack
• .diagcab
• .diagcfg
• .diagpkg
• .dll
• .drv
• .exe
• .hlp
• .icl
• .icns
• .ico
• .ics
• .idx
• .ldf
• .lnk
• .mod
• .mpa
• .msc
• .msp
• .msstyles
• .msu
• .nls
• .nomedia
• .ocx
• .prf
• .ps1
• .rom
• .rtp
• .scr
• .shs
• .spl
• .sys
• .theme
• .themepack
• .wpx
• .lock
• .key
• .hta
• .msi
• .pdb
• .{Generated Extension}