Ransom.Win32.MAOLOA.SM

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {malware path}\ids.txt -> contains encryption key and available drives
• %All Users Profile%\local\.{Machine GUID}
• {directory with encrypted files}\.{Machine GUID} -> contains encryption key, extension, ransom note file name

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Autostart Technique

This Ransomware creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunOnce
WindowsUpdateCheck = "{malware file path and name}.exe"

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\HomeGroup
DisableHomeGroup = "1"

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = "1"

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableRealtimeMonitoring = "1"

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = "1"

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = "1"

(Note: The default value data of the said registry entry is {User Preference}.)

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Default

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers

File Infection

This Ransomware avoids infecting files that contain the following strings in their names:

• windows
• bootmgr
• pagefile.sys
• boot
• ids.txt
• NTUSER.DAT
• PerfLogs

Other Details

This Ransomware does the following:

• It encrypts files in Remote, Fixed, Removable drives
• It avoids encrypting files with the following extensions:
  • dll
  • ini
  • lnk
  • sys
• It deletes shadow copies by executing the following commands:
  • vssadmin delete shadows /all /quiet
  • sc stop vss
  • sc config vss start=disabled
• It disables the following services by executing the following commands:
  • sc config browser
  • sc config browser start=enabled
  • sc stop MongoDB
  • sc config MongoDB start=disabled
  • sc stop SQLWriter
  • sc config SQLWriter start=disabled
  • sc stop MSSQLServerOLAPService
  • sc config MSSQLServerOLAPService start=disabled
  • sc stop MSSQLSERVER
  • sc config MSSQLSERVER start=disabled
  • sc stop MSSQL$SQLEXPRESS
  • sc config MSSQL$SQLEXPRESS start=disabled
  • sc stop ReportServer
  • sc config ReportServer start=disabled
  • sc stop OracleServiceORCL
  • sc config OracleServiceORCL start=disabled
  • sc stop OracleDBConsoleorcl
  • sc config OracleDBConsoleorcl start=disabled
  • sc stop OracleMTSRecoveryService
  • sc config OracleMTSRecoveryService start=disabled
  • sc stop OracleVssWriterORCL
  • sc config OracleVssWriterORCL start=disabled
  • sc stop MySQL
  • sc config MySQL start=disabled
• It clears event logs it enumerated by using the following:
  • wevtutil el -> enumerates event logs
  • wevtutil cl -> clears event logs

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .TROLL

It drops the following file(s) as ransom note:

• {directory with encrypted files}\HOW TO BACK YOUR FILES.txt

It leaves text files that serve as ransom notes containing the following text: