Ransom.Win32.BITPAYMER.TGACAL

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Application Data%\{Random Filename 1}
• %Application Data%\{Random Filename 2} -> random normal file can be found in system32
• %Application Data%\{Random Filename 2}:{Random Characters} -> copy of itself
• %Application Data%\{Random Characters}\{Random Filename 3} -> PUA.Win32.ProcHack.C
• %Application Data%\{Random Characters}\{Random Filename 4} -> PUA.Win32.ProcHack.C.component
• %Application Data%\{Random Characters}\WINSTA.dll -> Modified to proceed to its routine
• %User Temp%\{Random Characters}.tmp -> strings to delete all shadow copies
• %System%\msdtc.exe:0 -> Contains the original msdtc.exe content

It adds the following processes:

• %Application Data%\{Random Filename 2}:{Random Characters} {Argument to execute} {Malware Filename}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• MutexHelper

Other Details

This Ransomware does the following:

• It queries the following strings in the registry to gather information:
  • AppEvents
  • Console
  • Control Panel
  • Environment
  • EUDC
  • Identities
  • Keyboard Layout
  • Network
  • Printers
  • Software
  • System
  • Volatile Environment
  • UserName
  • UserProfile
  • HomePath
  • HomeDrive
  • AppData
  • LocalAppData
  • LogonServer
  • UserDomain
• It uses the following information to generate random characters for the file name it will drop:
  • Computer Name
• It uses the following set of commands to delete shadow copies:
  • %System%\vssadmin.exe Delete Shadows /All /Quiet
  • %System%\diskshadow.exe /s %User Temp%\{Random Characters}.tmp
• It executes the following command to gain the ownership of the service MSDTC:
  • %System%\takeown.exe /F %System%\msdtc.exe
  • %System%\icacls.exe %System%\msdtc.exe /reset
• It uses the following argument/parameter to proceed on it malicious routine:
  • 1xJ3P6g9rHq9Z9W3f0h7MP3T
• It execute the following set of commands before encrypting the file to gain its ownership:
  • "%System%\takeown.exe /F {Files to be encrypted}"
  • "%System%\icacls.exe {Files to be encrypted} /reset"
• It will encrypt the following set of drives in the affected system:
  • Network Drives
  • Fixed Drives
  • Removable Drives
• It uses the following set of commands to gather the network drives connected to the system and connect to the following network drives to encrypt it's files:
  • arp.exe -a
  • nslookup.exe {IP address}
• It executes the following files to escalate its privileges:
  • %Application Data%\{Random Characters}\{Random Characters 3} {Random Filename 4} 3884504681
• It replace the content of "%System%\msdtc.exe" with itself and the placed the original content of "%System%\msdtc.exe" to "%System%\msdtc.exe:0".

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• .DLL
• .exe
• schre*.bat
• svsho*.exe
• V01.lo*
• V01res*.jrs
• V01.ch*
• RacWmi*.sdf
• Web*V01.dat
• .ico
• .lnk
• .ini
• .chm
• .msi
• .sys
• .hlf
• .inf
• .lng
• .cmd
• .ttf

It avoids encrypting files with the following strings in their file path:

• RECYCLE.BIN
• System Volume Information
• %Windows%

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .locked

It drops the following file(s) as ransom note:

• {Encrypted File Name}.readme2unlock.txt