Ransom.Win32.GRIEF.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• vssadmin.exe Delete Shadows /All /Quiet
• bcdedit.exe /set {default} safeboot minimal
• bcdedit.exe /set {default} recoveryenabled No
• %System%\icacls.exe ":\*" /grant:r Everyone:F /t /c /q -> grant access to the drives it encrypts

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeCaption = We made you. P0G-{number}

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
LegalNoticeText =

Finalización del proceso

Finaliza procesos o servicios que contienen una de las cadenas siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• sqlagent
• sophos

Otros detalles

Hace lo siguiente:

• It expects itself to be executed as a service
• It installs itself as a service through modifying a service's ImagePath to point to itself and execute it along with its correct argument
• In these particular samples, there is currently no way to terminate processes. The embedded Process Hacker is not included in the ransomware samples, and it does not enumerate running processes
• It removes connections to network shared resources
• It requires a specific argument in order for it to proceed to its malicious routine
• It changes the password of every user to the following:
  • JaR99"Zd!51E4ECAE7509C3130AC4D2AD949E171F
• It initiates a system reboot after its installation