Ransom.MSIL.THANOS.THABGBA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Puede haberlo infiltrado otro malware.

Crea determinadas entradas de registro para deshabilitar aplicaciones relativas a la seguridad.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Puede haberlo infiltrado el malware siguiente:

• Trojan.W97M.THANOS.THABGBA

Instalación

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• e660f428-738e-469e-93fc-20803ca8aa37

Técnica de inicio automático

Este malware infiltra el/los archivo(s) siguiente(s) en la carpeta de inicio del usuario de Windows para permitir su ejecución automática cada vez que se inicia el sistema:

• %User Startup%\mystartup.lnk

(Nota: %User Startup% es la carpeta Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio\Programas\Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio\Programas\Inicio, en el caso de Windows 2003(32-bit), XP y 2000(32-bit) en C:\Documents and Settings\{nombre de usuario}\Menú Inicio\Programas\Inicio y en en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup).

Otras modificaciones del sistema

Crea las siguientes entradas de registro para deshabilitar aplicaciones relativas a la seguridad:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable = 1

Otros detalles

Hace lo siguiente:

• It terminates the following processes if found using the following commands:
  • "taskkill.exe" /IM mspub.exe /F
  • "taskkill.exe" /IM onenote.exe /F
  • "taskkill.exe" /IM agntsvc.exe /F
  • "taskkill.exe" /IM PccNTMon.exe /F
  • "taskkill.exe" /IM synctime.exe /F
  • "taskkill.exe" /IM thebat.exe /F
  • "taskkill.exe" /IM excel.exe /F
  • "taskkill.exe" /IM msaccess.exe /F
  • "taskkill.exe" /IM steam.exe /F
  • "taskkill.exe" /IM firefoxconfig.exe /F
  • "taskkill.exe" /IM CNTAoSMgr.exe /F
  • "taskkill.exe" /IM dbeng50.exe /F
  • "taskkill.exe" /IM sqlwriter.exe /F
  • "taskkill.exe" /IM infopath.exe /F
  • "taskkill.exe" /IM mspub.exe /F
  • "taskkill.exe" /IM Ntrtscan.exe /F
  • "taskkill.exe" /IM outlook.exe /F
  • "taskkill.exe" /IM mydesktopservice.exe /F
  • "taskkill.exe" /IM encsvc.exe /F
  • "taskkill.exe" /IM tbirdconfig.exe /F
  • "taskkill.exe" /IM mbamtray.exe /F
  • "taskkill.exe" /IM mydesktopqos.exe /F
  • "taskkill.exe" /IM thebat64.exe /F
  • "taskkill.exe" /IM zoolz.exe /F
  • "taskkill.exe" /IM tmlisten.exe /F
  • "taskkill.exe" /IM sqlservr.exe /F
  • "taskkill.exe" /IM winword.exe /F
  • "taskkill.exe" /IM visio.exe /F
  • "taskkill.exe" /IM mydesktopqos.exe /F
  • "taskkill.exe" /IM mydesktopservice.exe /F
  • "taskkill.exe" /IM mysqld.exe /F
  • "taskkill.exe" /IM isqlplussvc.exe /F
  • "taskkill.exe" /IM msftesql.exe /F
  • "taskkill.exe" /IM sqbcoreservice.exe /F
  • "taskkill.exe" /IM ocomm.exe /F
  • "taskkill.exe" IM thunderbird.exe /F
  • "taskkill.exe" /IM mysqld-nt.exe /F
  • "taskkill.exe" /IM dbsnmp.exe /F
  • "taskkill.exe" /IM powerpnt.exe /F
  • "taskkill.exe" /IM xfssvccon.exe /F
  • "taskkill.exe" /IM wordpad.exe /F
  • "taskkill.exe" /IM mysqld-opt.exe /F
  • "taskkill.exe" /IM ocautoupds.exe /F
• It terminates all running processes unless the following strings are found in the process name:
  • chrome
  • opera
  • msedge
  • iexplore
  • firefox
  • explorer
  • wininit
  • winlogon
  • SearchApp
  • SearchIndexer
  • SearchUI
• It checks if the following programs are running. If they are, the said programs are terminated, and the main ransomware program will terminate as well:
  • http analyzer stand-alone
  • fiddler
  • effetech http sniffer
  • firesheep
  • IEWatch Professional
  • wireshark portable
  • sysinternals tcpview
  • dumpcap
  • wireshark
  • ollydbg
  • x64dbg
  • x32dbg
  • dnspy
  • dnspy-x86
  • de4dot
  • ilspy
  • dotpeek
  • dotpeek64
  • ida64
  • RDG Packer Detector
  • CFF Explorer
  • PEiD
  • protection_id
  • LordPE
  • pe-sieve
  • MegaDumper
  • UnConfuserEx
  • Universal_Fixer
  • NoFuserEx
  • NetworkMiner
  • NetworkTrafficView
  • HTTPNetworkSniffer
  • tcpdump
  • intercepter
  • intercepter-NG
• It deletes the following registry subkeys to delete shadow copies:
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • vssadmin.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • wmic.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • wbadmin.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • bcdedit.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • powershell.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • diskshadow.exe
        
  • • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
      • net.exe
        
• The malware disables the following using powershell console:
  • "DisableRealtimeMonitoring"
  • "DisableBehaviorMonitoring"
  • "DisableBlockAtFirstSeen"
  • "DisableIOAVProtection"
  • "DisablePrivacyMode"
  • "SignatureDisableUpdateOnStartupWithoutEngine"
  • "DisableArchiveScanning"
  • "DisableIntrusionPreventionSystem"
  • "DisableScriptScanning"
  • "SubmitSamplesConsent"
  • "MAPSReporting"
  • "HighThreatDefaultAction"
  • "ModerateThreatDefaultAction"
  • "LowThreatDefaultAction"
  • "SevereThreatDefaultAction"