Ransom.Win32.SPOOSH.THGAGBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %System%\cmd.exe /C "vssadmin delete shadows /all /quiet"
• %System%\cmd.exe /C "rd /s /q %systemdrive%\$Recycle.bin"
• %System%\WindowsPowershell\v1.0\powershell.exe -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name EnableLinkedConnections -Value 1 -PropertyType 'DWord'"
• %System%\WindowsPowershell\v1.0\powershell.exe -Command "get-service LanmanWorkstation |Restart-Service –Force"
• attrib.exe -R {Directory to Encrypt}\{File Name to Encrypt}.{File Extension to Encrypt}
• mshta.exe %System Root%\Boot\cs-CZ\information.hta

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Printers\SettingsLow
DI = {8 Random Alphanumeric Characters}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkedConnections = 1

It sets the system's desktop wallpaper to the following image:

• %AppDataLocal%\wallpaper.jpg

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• Agntsvc.exe
• Dbeng50.exe
• Dbsnmp.exe
• Encsvc.exe
• Excel.exe
• Firefox.exe
• Infopath.exe
• Isqlplussvc.exe
• Msaccess.exe
• Mspub.exe
• Mydesktopqos.exe
• Mydesktopservice.exe
• Notepad.exe
• Ocautoupds.exe
• Ocomm.exe
• Ocssd.exe
• Onenote.exe
• Oracle.exe
• Outlook.exe
• Powerpnt.exe
• Sqbcoreservice.exe
• Sql.exe
• Steam.exe
• Synctime.exe
• Tbirdconfig.exe
• Thebat.exe
• Thunderbird.exe
• Ut.exe
• Utweb.exe
• Visio.exe
• Winword.exe
• Wordpad.exe
• Xfssvccon.exe

Dropping Routine

This Ransomware drops the following files:

• %AppDataLocal%\wallpaper.jpg

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Ransomware gathers the following data:

• Processor Name
• Memory
• Internal IP Address
• Manufacturer
• OS Version
• Computer Name
• Product Name
• External IP Address
• Device ID

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Printers\SettingsLow

It connects to the following website to send and receive information:

• tcp://{BLOCKED}.{BLOCKED}.154.137:21119

It does the following:

• It terminates itself if the computer language is Russian
• It downloads the desktop wallpaper to be set from the following url:
  
  • https://i.{BLOCKED}g.cc/JzpfvBFf/wallapaper.jpg
• It connects to the following url to identify the machine's external IP address:
  
  • https://{BLOCKED}rnalip.com

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• $RECYCLE.BIN
• $Recycle.Bin
• $WINDOWS.~BT
• $WINDOWS.~WS
• $WinREAgent
• $Windows.~WS
• AdwCleaner
• AppData
• dev
• Documents and Settings
• Hyberfil
• MSOCache
• Pagefile
• PerfLogs
• Program Files
• Program Files (x86)
• ProgramData
• Recovery
• SYSTEM.SAV
• System Volume Information
• Thumbs
• Thumbs.db
• Windows.old
• windows.old
• Windows.old.000
• windows.old.000

It appends the following extension to the file name of the encrypted files:

• .[[{8 Random Alphanumeric Characters}]].[[{Email Address}]].sophos

It drops the following file(s) as ransom note:

• {Encrypted Directory}\information.hta
• %System Root%\Boot\cs-CZ\information.hta
• 

It avoids encrypting files with the following file extensions:

• .adv
• .ani
• .bat
• .com
• .cpl
• .cur
• .deskthemepack
• .Devos
• .diagcab
• .diagcfg
• .diagpkg
• .dll
• .drv
• .faust
• .hlp
• .hta
• .icl
• .icns
• .ico
• .ics
• .idx
• .inf
• .ini
• .joker
• .key
• .ldf
• .lnk
• .lock
• .log
• .mkp
• .mod
• .mpa
• .msc
• .msp
• .msstyles
• .msu
• .nls
• .nomedia
• .ocx
• .prf
• .ps1
• .regtrans-ms
• .rom
• .rtp
• .scr
• .shs
• .sophos
• .spl
• .sys
• .theme
• .themepack
• .tmp
• .wpx