Ransom.Win32.AGENDA.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\QLOG\ThreadId(number).LOG.txt → logs execution status
  

Agrega los procesos siguientes:

• {malware filepath}/{malware filename} --password {string} --escalated --parent-sid {SID}
• "cmd" /C fsutil behavior set SymlinkEvaluation R2R:1
• "cmd" /C fsutil behavior set SymlinkEvaluation R2L:1
• "cmd" /C net use
• "cmd" /C wmic service where name='vss' call ChangeStartMode Manual
• "cmd" /C net start vss
• "cmd" /C vssadmin.exe delete shadows /all /quiet
• "cmd" /C net stop vss
• "cmd" /C wmic service where name='vss' call ChangeStartMode Disabled
• "powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)}

Crea las carpetas siguientes:

• %User Temp%\QLOG

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Otras modificaciones del sistema

Modifica las siguientes claves de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkedConnections = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\LanmanServer\Parameters
MaxMpxCt = 65535

Finalización del proceso

Finaliza los servicios siguientes si los detecta en el sistema afectado:

• vmms
• mepocs
• memtas
• veeam
• backup
• vss
• sql
• msexchange
• sophos
• msexchange\$
• wsbexchange
• pdvfsservice
• backupexecvssprovider
• backupexecagentaccelerator
• backupexecagentbrowser
• backupexecdivecimediaservice
• backupexecjobengine
• backupexecmanagementservice
• backupexecrpcservice
• gxblr
• gxvss
• gxclmgrs
• gxcvd
• gxcimgr
• gxmmm
• gxvsshwprov
• gxfwd
• sapservice
• sap
• sap\$
• sapd\$
• saphostcontrol
• saphostexec
• qbcfmonitorservice
• qbdbmgrn
• qbidpservice
• acronisagent
• veeamnfssvc
• veeamdeploymentservice
• veeamtransportsvc
• mvarmor
• mvarmor64
• vsnapvss
• acrsch2svc
• (.*?)sql(.*?)

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• vmms
• vmwp
• vmcompute
• agntsvc
• dbeng50
• dbsnmp
• encsvc
• excel
• firefox
• infopath
• isqlplussvc
• sql
• msaccess
• mspub
• mydesktopqos
• mydesktopservice
• notepad
• cautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• powerpnt
• sqbcoreservice
• steam
• ynctime
• tbirdconfig
• thebat
• thunderbird
• visio
• winword
• wordpad
• xfssvccon
• bedbh
• vxmon
• benetns
• bengien
• pvlsvr
• beserver
• raw_agent_svc
• vsnapvss
• cagservice
• qbidpservice
• qbdbmgrn
• qbcfmonitorservice
• sap
• teamviewer_service
• teamviewer
• tv_w32
• tv_x64
• cvmountd
• cvd
• cvfwd
• cvods
• saphostexec
• saposcol
• sapstartsrv
• avagent
• avscc
• dellsystemdetect
• enterpriseclient
• veeamnfssvc
• veeamtransportsvc
• veeamdeploymentsvc
• mvdesktopservice

Robo de información

Recopila los siguientes datos:

• Hostname
• Username

Otros detalles

Hace lo siguiente:

• It requires the correct password to proceed in its intended routine.
• It terminates itself if it detects that the sample is being executed in a virtual environment.
• It uses the CPUID assembly instruction to check if the sample is being executed in a virtual machine.
• The company ID in the ransom note is the same as the extension that it wil append to enrypted files.
• It encrypts local and shared/network drives.
• Impersonates the privileges of the following process:
  • lsass.exe
  • winlogon.exe
  • wininit.exe
• It logs its activities in a console.