Ransom.Win32.KUIPER.THAAHBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• cmd.exe /c "vssadmin resize shadowstorage /for={Drives A-Z}: /on=C: /maxsize=401MB"
• cmd.exe /c "wevtutil cl application"
• cmd.exe /c "wbadmin delete catalog -quiet"
• cmd.exe /c "bcdedit /set {default} recoveryenabled No"
• cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
• cmd.exe /c "wevtutil cl securit"
• cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
• cmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP"
• cmd.exe /c "wevtutil cl system"
• cmd.exe /c "powershell.exe -ep bypass -ec {Base64-encoded powershell script}"
  The following processes will spawned as a result of this command:
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im taskkill.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im tasklist.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im taskmgr.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im cmd.exe}"
  • powershell.exe -ep bypass -w hidden -c "while($true){ taskkill /f /im ps.exe}"
• cmd.exe /c taskkill /f /im {Process name from Termination list}
• cmd.exe /c net stop {Service name from Termination list} /y
• cmd.exe /c "shutdown /r /t 8"
• cmd.exe /c "reboot"

Process Termination

This Ransomware terminates the following services if found on the affected system:

• via net stop:
  • Avast Antivirus!
  • TMResponse
  • BackupExecAgentBrowser
  • AOTAgentSvc
  • TMBMServer
  • iVPAgent
  • Trend Micro
  • Web Service Communicator
  • Tmccst
  • Tmlisten
  • Ntrtscan
  • TmWSCSvc

It terminates the following processes if found running in the affected system's memory:

• via taskkill /f /im:
  • AOTAgent.exe
  • CETASvc.exe
  • powerpnt.exe
  • iVPAgent.exe
  • tmwscsvc.exe
  • ResponseService.exe
  • PccNTMon.exe
  • SupportConnector.exe
  • vastsvc.exe
  • avgsvc.exe
  • NortonSecurity.exe
  • McAfeeFramework.exe
  • KasperskyService.exe
  • SophosSAU.exe

Other Details

This Ransomware does the following:

• It prints the number of processors and execution logs to the console.
  
• It checks if the file size is greater than 198, 180, 854 bytes. These files will be partially encrypted for faster encryption.
• It checks if the file extension is any of the following. These files will be encrypted in its entirety regardless of the file size.
  • .sql
  • .txt
  • .db
  • .json

It accepts the following parameters:

• --help → Displays the help menu.
• -bm {yes|no} → Big mode ensures that large files encrypted first. (Default value: yes)
• -kill {yes|no} → Enables/disables the kill loop for the following applications: taskmgr, cmd, regedit, powershell. (Default value: no)
• -note {yes|no} → Defines whether the ransom note is dropped during the encryption process, or only once the encryption is finished. (Default value: yes)
• -p {path} → Specifies the targeted folder to encrypt files
• -reboot {yes|no} → Defines whether machine is rebooted after encryption. (Default value: yes)
• -rename {yes|no}→ Specifies if the ransom extension is appended to encrypted files. (Default value: yes)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• README_TO_DECRYPT.txt
• Program Files (x86)
• Windows
• Temp
• System32
• AppData
• SysWOW64
• BOOTNXT
• DumpStack.log.tmp
• pagefile.sys
• swapfile.sys
• desktop.ini
• ntuser.dat
• thumbs
• System Volume Information
• $Recycle.Bin
• perflogs
• App Data
• appdata
• ProgramData
• Recovery

It appends the following extension to the file name of the encrypted files:

• .kuiper

It drops the following file(s) as ransom note:

• {Encrypted Drive}\README_TO_DECRYPT.txt
• {Encrypted Directory}\README_TO_DECRYPT.txt
  

It avoids encrypting files with the following file extensions:

• .DAT
• .TMP
• .bak
• .bat
• .bin
• .blf
• .cfg
• .cmd
• .com
• .dat
• .dll
• .elf
• .exe
• .ini
• .lnk
• .msi
• .rtf
• .sys
• .tmp
• .desktop
• .Desktop
• .so
• .go
• .html
• .crlk
• .kuiper