Ransom.Win32.SPACECOLON.THKAGBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Malware File Path}\SelfDelete.bat → used to delete itself

It adds the following processes:

• powershell.exe -inputformat none -outputformat none -Noninteractive -Command Add-MpPreference -ExclusionPath"{Malware File Path}"
• cmd.exe /c "{Malware File Path}\SelfDelete.bat"

Process Termination

This Ransomware terminates the following services if found on the affected system:

• appinfo
• audioendpointbuilder
• audiosrv
• bthavctpsvc
• camsvc
• dispbrokerdesktopsvc
• dusmsvc
• installservice
• licensemanager
• rasman
• rmsvc
• securityhealthservice
• semgrsvc
• sgrmbroker
• sstpsvc
• storsvc
• sysmain
• tabletinputservice
• tokenbroker
• vaultsvc
• wbiosrvc
• deviceassociationservice
• wdiservicehost
• wdnissvc
• wscsvc
• wsearch
• cbdhsvc
• onesyncsvc
• pimindexmaintenancesvc
• cisssesrv
• unistoresvc
• helpsvc
• userdatasvc
• wpnuserservice
• ntlmssp
• ajrouter
• alg
• msciscsi
• bdesvc
• bits
• sysmgmthp
• deviceinstall
• dcpsvc
• cprqrcmc
• comsysapp
• efs
• cpqvcagent
• httpfilter
• simptcp
• ias
• dmserver
• ersvc
• wins
• wcncsvc
• appmgmt
• dosvc
• displayenhancementservice
• dtsapo4service
• vmauthdservice
• bluetoothuserservice
• hidserv
• vmware-converter-agent
• wlansvc
• protectedstorage
• wzcsvc
• clussvc
• aelookupsvc
• ntmssvc
• sysdown
• apphostsvc
• ccmexec
• cfvspm
• tapisrv
• fdphost
• ftpsvc
• iisadmin
• intel(r) proset monitoring service
• klnagent
• msmframework
• winfsp.launcher
• netlogon
• netman
• nfsclnt
• vmusbarbservice
• nfsservice
• remoteregistry
• sdd_service
• seclogon
• trustedinstaller
• uxsms
• w3svc
• was
• zabbix agent
• adws
• browser
• dfs
• dfsr
• dns
• gisvc
• ismserv
• kdc
• ntds
• vds
• vflragentd
• vgauthservice
• vm3dservice
• vmtools
• avpsus.kes
• Appreadiness
• Appxsvc
• Bfe
• Brokerinsfrastructure
• cdpsvc
• Certpropsvc
• Clipsvc
• Coremessagingregistrar
• cryptsvc
• Dcomlaunch
• Dhcp
• Diagtrack
• Dnscache
• N la
• Dps
• Dssvc
• Eventlog
• eventsystem
• Fa_scheduler
• Fontcache
• Gpsvc
• Ikeext
• Iphlpsvc
• Keyiso
• Lanmanserver
• Lanmanworkstation
• Lfsvc
• Lmhosts
• Lsm
• Mpssvc
• Msdtc
• Ncbservice
• Netprofm
• Clicktorunsvc
• Netsetupsvc
• N lasvc
• Nsi
• Pcasvc
• Plugplay
• Policyagent
• Power
• Profsvc
• Rpceptmapper
• Rpcss
• Samss
• Scdeviceenum
• Schedule
• Sens
• Sessionenv
• Shellhwdetection
• Spooler
• Ssdpsrv
• Staterepository
• Swprv
• Systemeventsbroker
• Termservice
• Themes
• Tiledatamodelsvc
• Timebrokersvc
• Trkwks
• Valsvc
• Vmrdpservice
• usermanager
• usosvc
• vmicheartbeat
• vmickvpexchange
• vmicrdv
• vmicshutdown
• vmictimesync
• vmicvss
• vss
• w32time
• wcmsvc
• wdisystemhost
• windefend
• winhttpautoproxysvc
• winmgmt
• winrm
• wlidsvc
• wlms
• wpnservice
• wuauserv
• wudfsvc
• cdpusersvc

It terminates the following processes if found running in the affected system's memory:

• vserver.exe
• vmwaretray.exe
• Groovemonitor.exe
• searchindexer.exe
• Sysmon.exe
• vdisk.exe
• Procmon.exe
• SysTracerx32.ee
• TcpLogView.exe
• ProcessHacker.exe
• Fiddler.exe
• everything.exe
• sublime_text.exe
• plugin_host.exe
• powershell.exe
• wmpnetwk.exe
• Ollydbg.exe
• die.exe
• Taskeng.exe
• Audiodg.exe
• Searchprotocolhost.exe
• smss.exe
• csrss.exe
• wininit.exe
• winlogon.exe
• services.exe
• lsass.exe
• svchost.exe
• LogonUI.exe
• dwm.exe
• VSSVC.exe
• CompatTelRunner.exe
• spoolsv.exe
• wlms.exe
• FCDBLog.exe
• sppsvc.exe
• conhost.exe
• SppExtComObj.Exe
• rdpclip.exe
• RuntimeBroker.exe
• sihost.exe
• taskhostw.exe
• userinit.exe
• explorer.exe
• ShellExperienceHost.exe
• SearchUI.exe
• WmiPrvSE.exe
• mobsync.exe
• cmd.exe
• tasklist.exe
• fontdrvhost.exe
• LsaIso.exe
• MsMpEng.exe
• amService.exe
• blnsvr.exe
• Project1.exe
• app.exe
• msdtc.exe
• lsm.exe
• cissesrv.exe
• cqmghost.exe
• cqmgserv.exe
• cqmgstor.exe
• snmp.exe
• taskhost.exe
• vmware-usbarbitrator64.exe
• vmtoolsd.exe
• VGAuthService.exe
• ctfmon.exe
• StartMenuExperienceHost.exe
• WUDFHost.exe
• fsptool-x64.exe
• ssh.exe
• sshfs.exe
• sshfs-win.exe
• enc.exe
• Analyzer.exe
• msiexec.exe
• putty.exe
• auto.exe
• KeePass.exe
• mRemoteNG.exe

Other Details

This Ransomware does the following:

• Empty Recycled Bin
• Terminates itself if the following file is present:
  • %ProgramData%\dont.txt

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .mdf
• .ldf
• .ndf
• .dbf
• .db
• .dbs
• .log1
• .dat
• .mdb
• .ora
• .fdb
• .wt
• .gdb
• .bak
• .backup
• .vib
• .vbk
• .vbm
• .tib
• .tibx
• .dmp
• .tuf
• .trn
• .zip
• .7z
• .rar
• .archive
• .vhd
• .vhdx
• .avhdx
• .rct
• .pst
• .sql
• .pdf
• .xlsx
• .xls
• .doc
• .docx
• .pstx
• .vmdk
• .vmx
• .fbk
• .ibd
• .myd
• .mdbx
• .d0
• .d1
• .d3
• .b1
• .bck
• .tiff
• .tif
• .dwg
• .dxf
• .lbl
• .db1
• .001
• .0001
• .seq
• .vix
• .bkf
• .gbk
• .ova
• .eml
• .ptb
• .saj
• .sko
• .skp
• .srd
• .nyf
• .itdb
• .dbc
• .edb
• .nsf
• .ib
• .db2
• .ai
• .ost
• .ostx
• .002
• .003
• .004
• .005
• .006
• .007
• .cbd
• .d2
• .d4
• .da1
• .da2
• .da3
• .da4
• .rpd
• .edp
• .vrb
• .vswp
• .idx
• .ebk
• .rpt
• .vct
• .vcx
• .cdx
• .hbp
• .msg
• .ldb
• .alt
• .dbw
• .qrp
• .upd
• .old
• .jet
• .ol2
• .sic
• .bco
• .hrl
• .a06
• .a01
• .a02
• .a03
• .bac
• .3dm
• .3dmbak
• .psd
• .jpg
• .mp4
• .mov
• .pptx
• .ppt
• .tmp
• .cdr
• .ard
• .usr
• .btr
• .qvx
• .008
• .hlp
• .sldrpt
• .SLDLFP
• .SLDPRT
• .SLDDRW
• .rfs
• .llp
• .slp
• .spl
• .one
• .SLDASM
• .gan
• .rpo
• .ntf
• .ndk
• .nbf
• .nx1
• .bik
• .dxt5_2d
• .cgd
• .tga
• .avi
• .pak
• ._ms
• .danger
• .tar
• .tar.gz
• .frm
• .myi
• .accdb
• .sqlite
• .sqlite3
• .redo
• .log
• .box
• .ndx
• .nsg
• .fmp12
• .fp7
• .fp5
• .couch
• .qbw
• .qbb
• .qba
• .qbm
• .sai
• .xlsm
• .indd
• .3ds
• .max
• .blend
• .qic
• .sna
• .gho
• .ghs
• .iv2i
• .pbd
• .pqb
• .afi
• .mrimg
• .spf
• .bi4
• .rbf
• .obk
• .oeb
• .rdb
• .bup
• .bkup
• .cfgbak
• .nb7
• .lst
• .cbu
• .bpf
• .ctf
• .bkp
• .fbf
• .fbw
• .ful
• .stm
• .imd
• ibdata
• .vmsd
• .vmsn
• .csv
• .elg
• .fxl
• .bln
• .mtx
• .bil
• .egl
• .xxx
• .fxl

It avoids encrypting files with the following strings in their file name:

• NTUSER.dat
• Icudtl.dat
• NTUSER.dat.log1
• Usrclass.dat
• Usrclass.dat.log1
• Webcachev01.dat
• Thumbs.db
• Common files
• Unins00
• Windows.edb

It appends the following extension to the file name of the encrypted files:

• {Based 64 file name}.Encrypted

It drops the following file(s) as ransom note:

• {Encrypted Directory}\HOW TO RECOVERY FILES.TXT