Ransom.Win32.HIDDENTEAR.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Temp%\update.{Random}.mwt
• %Program Data%\encryption.{10 Random Characters}.enc.key.plain
• %Program Data%\encryption.{10 Random Characters}.enc.key
• %Temp%\encryption.log → if already exist, it will not proceed to its malicious routine

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

It adds the following processes:

• netsh advfirewall firewall add rule name="Port 80" dir=out action=block protocol=TCP remoteport=80
• netsh advfirewall firewall add rule name="Port 443" dir=out action=block protocol=TCP remoteport=443
• netsh advfirewall firewall add rule name="Port 4122out" dir=out action=block protocol=TCP remoteport=4122 localport=4122
• netsh advfirewall firewall add rule name="Port 4118-4119out" dir=out action=block protocol=TCP remoteport=4118-4119 localport=4118-4119
• netsh advfirewall firewall add rule name="Port 5274-5275out" dir=out action=block protocol=TCP remoteport=5274-5275 localport=5274-5275
• netsh advfirewall firewall add rule name="Port 4122in" dir=in action=block protocol=TCP remoteport=4122 localport=4122
• netsh advfirewall firewall add rule name="Port 4118-4119in" dir=in action=block protocol=TCP remoteport=4118-4119 localport=4118-4119
• netsh advfirewall firewall add rule name="Port 5274-5275in" dir=in action=block protocol=TCP remoteport=5274-5275 localport=5274-5275
• %Temp%\update.{Random}.mwt true %ProgramData%\encryption.{10 Random Characters}.enc.key.plain
• cmd /c "taskkill /F /IM {Target Process}"

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• via taskkill /F /IM:
  • pg_ctl.exe
  • postgres.exe
  • mysqld.exe
  • sqlservr.exe
  • sqlwriter.exe
  • sqlceip.exe

Other Details

This Ransomware does the following:

• It targets files and folders in local drives, network shares, and removable drives.
• It encrypts files related to Microsoft SQL which contain the following strings in their file path:
  • {Drive Letter}\Program Files\*MSSQL*
  • {Drive Letter}\Program Files (x86)\*MSSQL*
• It adds the following processes if these Windows Firewall rule exists:
  • netsh advfirewall firewall delete rule name="Port 80"
  • netsh advfirewall firewall delete rule name="Port 443"
  • netsh advfirewall firewall delete rule name="Port 4122in"
  • netsh advfirewall firewall delete rule name="Port 4118-4119in"
  • netsh advfirewall firewall delete rule name="Port 5274-5275in"
  • netsh advfirewall firewall delete rule name="Port 4122out"
  • netsh advfirewall firewall delete rule name="Port 4118-4119out"
  • netsh advfirewall firewall delete rule name="Port 5274-5275out"
• It requires a specific file name and path to proceed to its malicious routine. → "%Temp%\update.mwt"
  • When executed without this file name, it will repeatedly create %Temp%\update.{Random}.mwt until it crashed the system.
• It requires to be executed as an administrator.
  • When executed without admin privilege, it will encrypt network shares and will not create processes for Windows Firewall rules.

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• .enc.key
• .enc
• .lnk
• .reg
• .sys
• .tmp
• @RANSOMWARE@README.md
• $Recycle.Bin
• $WinREAgent
• AppData
• desktop.ini
• Desktop.ini
• eScan
• file_encryption
• ntuser
• NTUSER
• PerfLogs
• Program Files
• Recovery
• Windows

It appends the following extension to the file name of the encrypted files:

• .enc

It drops the following file(s) as ransom note:

• %Desktop%\@RANSOMWARE@README.md
• {Encrypted path}\@RANSOMWARE@README.md