Ransom.Win64.GROUNDE.THGOEBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Encrypted Directory}\!!readme!!!.txt
• {Malware File Path}\temp.cmd → Used to delete itself

It adds the following processes:

• "%System%\vssadmin.exe" delete shadows /all /quiet
• "%System%\net.exe" stop MSSQLSERVER /f /m
• cmd /c temp.cmd {Malware File Path}/{Malware File Name}.{Malware Extension}

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 1209600000

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• !!readme!!!.txt
• VIPinfo.txt

It avoids encrypting files with the following strings in their file path:

• \microsoft\
• \google\chrome
• \mozilla\firefox
• \opera\
• C:\windows

It drops the following file(s) as ransom note:

• {Encrypted Directory}\!!readme!!!.txt
  

It avoids encrypting files with the following file extensions:

• sys
• exe
• dll
• bat
• bin
• cmd
• com
• cpl
• gadget
• inf1
• ins
• inx
• isu
• job
• jse
• lnk
• msc
• msi
• mst
• paf
• pif
• rgs
• scr
• sct
• shb
• shs
• u3p
• vb
• vbe
• vbs
• vbscript
• ws
• wsh
• wsf