Ransom.MSIL.VIGRA.THIODAIA

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• vssadmin Delete Shadows /All /Quiet → deletes shadow copies
• cipher /W:%System Root%:\ → wipes data from %System Root%
• fsutil usn deletejournal /D %System Root% → delete an active USN change journal on %System Root%
• shutdown -L → logs off the current user on machine

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Desktop%\BACKGROUND.BMP

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
legalnoticecaption = Viagra yungthugger (V-0.1.31)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
legalnoticetext = {user name}, your files are encrypted. Look for README-VIAGRA-{8 random characters}.HTML in every folder, for instructions on how to get your files back.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
RegisteredOwner = {user name}, your files are encrypted. Look for README-VIAGRA-{8 random characters}.HTML in every folder, for instructions on how to get your files back.

It sets the system's desktop wallpaper to the following image:

Dropping Routine

This Ransomware drops the following files:

• %Desktop%\BACKGROUND.BMP → used as wallpaper

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Ransomware encrypts files with the following extensions:

• .txt
• .doc
• .jpg
• .ogg
• .jpeg
• .tif
• .tiff
• .png
• .docx
• .docm
• .xlsm
• .xlsx
• .pdf
• .pptm
• .pptx
• .ppt
• .xls
• .xla
• .dot
• .dotm
• .odb
• .odf
• .bmp
• .odg
• .htm
• .html
• .xml
• .pfx
• .bit
• .pdf
• .com
• .css
• .js
• .vbs
• .sln
• .au3
• .flac
• .url
• .ini
• .cfg
• .conf
• .avi
• .mp3
• .m4a
• .3gp
• .vid
• .vob
• .asm
• .webmoney
• .sav
• .nth
• .java
• .jar
• .sis
• .key
• .$$$
• .reg
• .apk
• .ncf
• .navpath
• .nfo
• .nokogiri
• .nrg
• .nsh
• .rtf
• .nvram
• .oa2
• .oa3
• .obj
• .obt
• .obx
• .obz
• .ocr
• .odif
• .odo
• .oda
• .odl
• .osd
• .osf
• .ps1
• .p01
• .p10
• .p12
• .7z
• .rar
• .zip
• .arj
• .tar.gz
• .tar
• .pak
• .pcd
• .pdb
• .pdc
• .prc
• .peb
• .pef
• .cad
• .pkg
• .ply
• .ppx
• .proofingtool
• .ps
• .pub
• .pubx
• .py
• .pyc
• .pys
• .qbx
• .r00
• .rw
• .rwlibrary
• .so
• .sam
• .sh
• .shtml
• .xhtml
• .smh
• .opus
• .sql
• .sqlite1
• .sqlite
• .spb
• .ssh
• .struct
• .suf
• .ssx
• .tex
• .tdr
• .jtd
• .tga
• .torrent
• .tor
• .tml
• .lua
• .tgz
• .thm
• .web
• .wdb
• .gif
• .gadget
• .erf
• .wmv
• .mov
• .cdr
• .qbm
• .x11
• .war
• .eps
• .bik
• .jtt
• .go
• .602
• .c
• .cs
• .h
• .cpp
• .hpp
• .sln
• .rdb
• .cer
• .mp2
• .xhtml
• .php
• .mf
• .xsl
• .sheet
• .sas7bdat
• .djvu
• .stone
• .tga
• .eml
• .mmpz
• .mmp
• .bin
• .3g2
• .sql
• .3dm
• .wks
• .wps
• .mpa
• .wpl
• .deb
• .elf
• .dbg
• .sav
• .csv
• .cgi
• .bat
• .wsf
• .svg
• .ico
• .cfm
• .rss
• .class
• .sh
• .swift
• .mkv
• .sb
• .pk3
• .skb
• .szs
• .prz
• .mpp
• .spc
• .myd
• .ccp4
• .eossa
• .cdf
• .ps1
• .ps1xml
• .p7b
• .p7c
• .gsm
• .vgm
• .bkp
• .band
• .hs
• .gml
• .e
• .d
• .xpl
• .osr
• .osu
• .mcpack
• .mctemplate
• .lip
• .3ds
• .wad
• .gba
• .gbc
• .fds
• .maf
• .jsp
• .ihtml
• .cps
• .vb

It does the following:

• It deletes the original files after encryption.
• It modifies the volume label of encrypted drives to EnCiPhErEd-{8 random characters}.
• It displays the following window upon execution:
  
• It creates the following Windows pre-login message:
  

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• %System Root%\Users
• %System Root%\Documents and Settings
• %System Root%\xampp

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .{base-64 encoded string}{4 random characters}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\README-VIAGRA-{8 random characters}.HTM