Ransom.Win32.TARGETCOMP.YXCKCZ

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• "%System%\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /c bcdedit /set {current} recoveryenabled no
• "%Windows%\sysnative\vssadmin.exe" delete shadows /all /quiet
• taskill -f -im {Stopped Processes}
• sc delete {Deleted Services}

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideShutDown
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideRestart
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideSignOut
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
shutdownwithoutlogon = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0

It deletes the following registry keys:

HKEY_CURRENT_USER\SOFTWARE\Raccine

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\EventLog\Application\
Raccine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vssadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wmic.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wbadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bcdedit.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
powershell.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
diskshadow.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
net.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskkill.exe

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• sqlserv.exe
• oracle.exe
• ntdbsmgr.exe
• sqlservr.exe
• sqlwriter.exe
• MsDtsSrvr.exe
• msmdsrv.exe
• ReportingServecesService.exe
• fdhost.exe
• fdlauncher.exe
• mysql.exe


• where (Stopped Processes}
• sqlwriter.exe
• sqlservr.exe
• msmdsrv.exe
• MsDtsSrvr.exe
• sqlceip.exe
• fdlauncher.exe
• Ssms.exe
• SQLAGENT.EXE
• fdhost.exe
• fdlauncher.exe
• sqlservr.exe
• ReportingServicesService.exe
• msftesql.exe
• pg_ctl.exe
• postgres.exe

Information Theft

This Ransomware gathers the following data:

• Computer Name
• Product Name
• OS Architecture
• Application Privilege

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.191.141/QWEwqdsvsf/ap.php

Other Details

This Ransomware does the following:

• It encrypts files from local drives, removable drives, and network shares.
• It DOES NOT continue to routine if User Default Language ID of the system is any of the following:
• Russian (0x419)
• Kazakh (0x43F)
• Belarusian (0x423)
• Ukrainian (0x422)
• Tatar (0x444)
• It blocks any system shutdown and displays the following the message:
  • "Do NOT shutdown OR reboot your PC: this might damage your files permanently !"
• It reverts the following modified registries entries back to its default values after encryption:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Policies\System\shutdownwithoutlogon
• It deletes the following services {Deleted Services}:
  • MSSQLFDLauncher
  • MSSQLSERVER
  • SQLSERVERAGENT
  • SQLBrowser
  • SQLTELEMETRY
  • MsDtsServer130
  • SSISTELEMETRY130
  • SQLWriter
  • MSSQL$VEEAMSQL2012
  • SQLAgent$VEEAMSQL2012
  • MSSQL
  • SQLAgent
  • MSSQLServerADHelper100
  • MSSQLServerOLAPService
  • MsDtsServer100
  • ReportServer
  • SQLTELEMETRY$HL
  • TMBMServer
  • MSSQL$PROGID
  • MSSQL$WOLTERSKLUWER
  • SQLAgent$PROGID
  • SQLAgent$WOLTERSKLUWER
  • MSSQLFDLauncher$OPTIMA
  • MSSQL$OPTIMA
  • SQLAgent$OPTIMA
  • ReportServer$OPTIMA
  • msftesql$SQLEXPRESS
  • postgresql-x64-9.4

It accepts the following parameters:

• -l
• -d
• -p
• -path {path to encrypt} → encrypts specific path inputted on the command-line.

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .bak
• .zip
• .rar
• .7z
• .gz
• .sql
• .mdf
• .hdd
• .vhd
• .vdi
• .vmx
• .vmdk
• .nvram
• .vmem
• .vmsn
• .vmsd
• .vmss
• .lck
• .vhdx
• .vhd
• .dbf
• .ora
• .oraenv
• .dmp
• .ibd
• .mdb

It avoids encrypting files with the following strings in their file name:

• desktop.ini
• ntuser.dat
• thumbs.db
• iconcache.db
• ntuser.ini
• ntldr
• bootfont.bin
• ntuser.dat.log
• bootsect.bak
• boot.ini
• autorun.inf
• debugLog.txt
• target.exe
• FILE RECOVERY.txt

It avoids encrypting files with the following strings in their file path:

• msocache
• $windows.~ws
• system volume information
• intel
• appdata
• perflogs
• programdata
• google
• application data
• tor browser
• boot
• $windows.~bt
• mozilla
• boot
• windows.old
• Windows Microsoft.NET
• WindowsPowerShell
• Windows NT
• Windows
• Common Files
• Microsoft Security Client
• Internet Explorer
• Reference
• Assemblies
• Windows Defender
• Microsoft ASP.NET
• Core Runtime
• Package
• Store
• Microsoft Help Viewer
• Microsoft MPI
• Windows Kits
• Microsoft.NET
• Windows Mail
• Microsoft Security Client
• Package Store
• Microsoft Analysis Services
• Windows Portable Devices
• Windows Photo Viewer
• Windows Sidebar

It appends the following extension to the file name of the encrypted files:

• .mallox

It drops the following file(s) as ransom note:

• {Drive Letter:}\FILE RECOVERY.txt
• {Encrypted Directory:}\FILE RECOVERYS.txt

It avoids encrypting files with the following file extensions:

• .msstyles
• .icl
• .idx
• .avast
• .rtp
• .mallox
• .sys
• .nomedia
• .dll
• .hta
• .cur
• .lock
• .cpl
• .Globeimposter-Alpha865qqz
• .ics
• .hlp
• .com
• .spl
• .msi
• .key
• .mpa
• .rom
• .drv
• .bat
• .386
• .adv
• .diangcab
• .mod
• .scr
• .theme
• .ocx
• .prf
• .cab
• .diagcfg
• .msu
• .cmd
• .ico
• .msc
• .ani
• .icns
• .diagpkg
• .deskthemepack
• .wpx
• .msp
• .bin
• .themepack
• .shs
• .nls
• .exe
• .lnk
• .ps1
• .mallox
• .mdf
• .bak