Ransom.Win32.JAMPER.THCBAAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system and executes them:

• %Application Data%\Firewall and Security.{GUID}\defender.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

It adds the following processes:

• ping -n 3 127.1

It creates the following folders:

• %Application Data%\Firewall and Security.{GUID}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Defender = %Application Data%\Firewall and Security.{GUID}\defender.exe *

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Vega\
Service
Public = {base64 encoded data}

HKEY_CURRENT_USER\Software\Vega\
Service
Private = {base64 encoded data}

Other Details

This Ransomware does the following:

• It avoids encrypting files with the following file extensions:
  • .bat
  • .cmd
  • .com
  • .cpl
  • .dll
  • .lnk
  • .msc
  • .msp
  • .pif
  • .scr
  • .sys
  • .vega
• It encrypts files in fixed, removable and network drives.
• It disables system recovery, deletes backup catalog, deletes system state backup, and deletes shadow volume copies using the following commands:
  • cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
  • cmd.exe /C bcdedit /set {default} recoveryenabled no
  • cmd.exe /C wbadmin delete catalog -quiet
  • cmd.exe /C wbadmin delete systemstatebackup
  • cmd.exe /C wbadmin delete systemstatebackup -keepversions:0
  • cmd.exe /C wbadmin delete backup
  • cmd.exe /C wmic shadowcopy delete
  • cmd.exe /C vssadmin delete shadows /all /quiet

It deletes itself after execution.

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• %All Users Profile%
• %Application Data%
• %ProgramData%
• %Windows%

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000, XP, and Server 2003, or C:\ProgramData on Windows Vista, 7, and 8. . %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData in Windows Vista, 7, and 8.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .jamper

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\---README---.TXT