Ransom.Win32.STOP.THFAHAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It saves downloaded files into the said created folder.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %AppDataLocal%\{GUID}\{malware file name}.exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %System Root%\SystemID\PersonalID.txt

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following processes:

• icacls "%AppDataLocal%\{GUID}" /deny *S-1-1-0:(OI)(CI)(DE,DC)
• "{Executed Malware File Path}\{Executed Malware File Name}.exe" --Admin- IsNotAutoStart IsNotTask ← malware is executed as Admin and not executed as autorun registry or via task

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %System Root%\SystemID
• %AppDataLocal%\{GUID} ← two(2) folders one(1) for drop copy and one(1) for downloaded files.

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
• {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SysHelper = ""%AppDataLocal%\{GUID}\{Malware File Name}.exe" --AutoStart"

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
SysHelper = 1

Download Routine

This Ransomware connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}2.hk/tesptc/penelop/updatewin1.exe
• http://{BLOCKED}2.hk/tesptc/penelop/updatewin2.exe
• As of this writing, below are the following inaccessible sites:
  • http://{BLOCKED}2.hk/tesptc/penelop/updatewinx.exe
  • http://{BLOCKED}2.hk/tesptc/penelop/3.exe
  • http://{BLOCKED}2.hk/tesptc/penelop/4.exe
  • http://{BLOCKED}2.hk/tesptc/penelop/5.exe

Trend Micro detects the dowloaded file as:

• Trojan.Win32.MALREP.THOABAAI

It saves downloaded files into the said created folder.

Other Details

This Ransomware does the following:

• Connects to the URL to get the arguments needed for the "--Service" and "--ForNetRes" to perform it's routine:
  
  • http://{BLOCKED}1.hk/dfgdfgdf26/khjkhjkhjkh/get.php?pid={Hash PID}&first=true
• Checks if there is an existing copy of itself in %AppDataLocal% then delete it and drops a copy of itself at %AppDataLocal%
• Adds the following Scheduled Task:
  
  • Task Name: Time Trigger Task
  Schedule: Once, after triggered repeat every 5 mins. Trigger expires at 5/2/2030 8:00 AM
  Task to be run: "%AppDataLocal%\{GUID}\{Malware File Name}.exe"
• It accepts/ add the following arguments to check its execution:
  
  • --Admin -> run the malware as admin
  • --AutoStart -> executes using autorun registry keys.
  • --ForNetRes {Argumet from the URL} {Argument From the URL}
  • --Service {PID of the Parent Malware Running} {Argumet from the URL} {Argument From the URL}
  • IsAutoStart -> Execute malware as an autostart
  • IsNotAutoStart -> Execute malware not as an autostart
  • IsTask/Task -> Execute malware as a task
  • IsNotTask -> Execute malware not as a task
• It connects to the following URL(s) to get the affected system's IP address and location:
  • https://{BLOCKED}i.{BLOCKED}p.ua/geo.json
    • It terminate and delete itself on the affected sysyem if the return of the IP address location are the following:
      • RU (Russia)
      • BY (Belarus)
      • UA (Ukraine)
      • AZ (Azerbaijan)
      • AM (Armenia)
      • TJ (Tajikistan)
      • KZ (Kazakhstan)
      • KG (Kyrgyzstan)
      • UZ (Uzbekistan)
      • SY (Syrian Arab Republic)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• ntuser.dat
• .sys
• .bat
• .dll
• .lnk
• .ini
• _readme.txt
• .DLL
• .blf
• ntuser.dat.LOG1
• ntuser.dat.LOG2
• ntuser.pol
• .regtrans-ms

It avoids encrypting files found in the following folders:

• C:\Users\Public\
• C:\SystemID\
• C:\Users\Default User\
• C:\Users\Public\
• C:\Users\All Users\
• C:\Users\Default\
• C:\Documents and Settings\
• C:\ProgramData\
• C:\Recovery\
• C:\System Volume Information\
• C:\Users\%username%\AppData\Roaming\
• C:\Users\%username%\AppData\Local\
• C:\Windows\
• C:\PerfLogs\
• C:\ProgramData\Microsoft\
• C:\ProgramData\Package Cache\
• C:\Users\Public\
• C:\$Recycle.Bin\
• C:\$WINDOWS.~BT\
• C:\dell\
• C:\Intel\
• C:\MSOCache\
• C:\Program Files\
• C:\Program Files (x86)\
• C:\Games\
• C:\Windows.old\
• D:\Users\%username%\AppData\Roaming\
• D:\Users\%username%\AppData\Local\
• D:\Windows\
• D:\PerfLogs\
• D:\ProgramData\Desktop\
• D:\ProgramData\Microsoft\
• D:\ProgramData\Package Cache\
• D:\Users\Public\
• D:\$Recycle.Bin\
• D:\$WINDOWS.~BT\
• D:\dell\
• D:\Intel\
• D:\MSOCache\
• D:\Program Files\
• D:\Program Files (x86)\
• D:\Games\
• E:\Users\%username%\AppData\Roaming\
• E:\Users\%username%\AppData\Local\
• E:\Windows\
• E:\PerfLogs\
• E:\ProgramData\Desktop\
• E:\ProgramData\Microsoft\
• E:\ProgramData\Package Cache\
• E:\Users\Public\
• E:\$Recycle.Bin\
• E:\$WINDOWS.~BT\
• E:\dell\
• E:\Intel\
• E:\MSOCache\
• E:\Program Files\
• E:\Program Files (x86)\
• E:\Games\
• F:\Users\%username%\AppData\Roaming\
• F:\Users\%username%\AppData\Local\
• F:\Windows\
• F:\PerfLogs\
• F:\ProgramData\Desktop\
• F:\ProgramData\Microsoft\
• F:\Users\Public\
• F:\$Recycle.Bin\
• F:\$WINDOWS.~BT\
• F:\dell\
• F:\Intel\

It appends the following extension to the file name of the encrypted files:

• .herad

It drops the following file(s) as ransom note:

• {Encrypted File Directory}\_readme.txt