Ransom.Win32.RANINC.SMYXECXT

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\background-image.jpg
• %System%\spool\PRINTERS\00002.SPL
• %System%\spool\PRINTERS\00002.SHD

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• bcdedit.exe /set {default] safeboot network → If --safe-mode parameter is used.
• shutdown.exe -r → If --safe-mode parameter is used.

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon
(Default) = %System%\imageres.dll,-55

(Note: The default value data of the said registry entry is %System%\imageres.dll,-54.)

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\background-image.jpg

It sets the system's desktop wallpaper to the following image:

• %User Temp%\background-image.jpg
  

Process Termination

This Ransomware terminates the following services if found on the affected system:

• sql
• veeam
• backup
• exchange

It terminates the following processes if found running in the affected system's memory:

• sql
• veeam
• backup
• exchange
• java

Other Details

This Ransomware adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\{Current Control Set}\
Control\SafeBoot\Network\
dmksvc → If --safe-mode parameter is used

HKEY_LOCAL_MACHINE\SYSTEM\{Current Control Set}\
Control\SafeBoot\Minimal\
dmksvc → If --safe-mode parameter is used

It does the following:

• Empty Recycled Bin
• It enumerates printers in the network to print the ransom note.
• It encrypts fixed, removable, and network drives.
• It adds the following services: → If --safe-mode parameter is used
  • Name: dmksvc
  • Start Type: AutoStart
  • Binary Path: {Malware File Path}\{Malware Filename}

It accepts the following parameters:

• --debug → Display logs within the command prompt.
• --file {File Path} → Encrypts the specified file.
• --dir {Directory Path} → Encrypts the specified directory.
• --sup → Uses the Windows Restart Manager API to close processes or shut down Windows services that may be keeping a file open and preventing encryption.
• --ens → Enumerates available network shares to encrypt.
• --lhd → Encrypt hidden drives.
• --hide → Hide console window.
• --safe-mode → Boots the machine in safe mode.
• --help→ Display help information.
• --kill → Kill process/services by mask.
• --mode → Mode of File Encryption.
  • Fast→ Encrypts a fixed value of 1,000,000 bytes and skips a larger bytes.
  • Medium → Encrypts a fixed value of 1,000,000 bytes and skips a smaller bytes compared to fast mode.
  • Slow → Encrypt the whole file.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• windows
• program files
• program files (x86)
• $RECYCLE.BIN
• appdata
• microsoft sql server

It appends the following extension to the file name of the encrypted files:

• {original file name}.{original extension}.INC

It drops the following file(s) as ransom note:

• {Encrypted Directory}\INC-README.txt
  
• {Encrypted Directory}\INC-README.html
  

It avoids encrypting files with the following file extensions:

• .exe
• .msi
• .dll
• .inc