Ransom.Win32.VEGA.THBAAAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• cscript //e:vbscript //nologo %User Temp%\temp.txt
• chcp 1250 && net view -> used to gather list of computers and devices on the network

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Ransomware deletes the following files:

• %User Profile%\documents\Default.rdp

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers

It deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Default

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• agntsvc.exe
• anvir.exe
• anvir64.exe
• ccleaner.exe
• ccleaner64.exe
• dbeng50.exe
• dbsnmp.exe
• encsvc.exe
• far.exe
• firefoxconfig.exe
• infopath.exe
• isqlplussvc.exe
• isqlplussvc.exe
• msaccess.exe
• msftesql.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• ncsvc.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• oracle.exe
• powershell.exe
• procexp.exe
• regedit.exe
• sqbcoreservice.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlserver.exe
• sqlservr.exe
• sqlwriter.exe
• synctime.exe
• tasklist.exe
• taskmgr.exe
• tbirdconfig.exe
• visio.exe
• xfssvccon.exe

Dropping Routine

This Ransomware drops the following files:

• %User Temp%\{random numbers}
• %User Temp%\temp.txt -> used to retrieve information in the affected system

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Ransomware gathers the following data:

• OS Information
• Volume Information
• Installed Applications

Other Details

This Ransomware does the following:

• It disables system recovery, deletes backup catalog, deletes system state backup, and deletes shadow volume copies using the following commands:
  • bcdedit /set {default} bootstatuspolicy ignoreallfailures
  • bcdedit /set {default} recoveryenabled no
  • wbadmin delete catalog -quiet
  • wbadmin delete systemstatebackup
  • wbadmin delete backup
  • wmic shadowcopy delete
  • vssadmin delete shadows /all /quiet
• It encrypts files found in network resources and local drives
• It terminates itself if it satisfies any of the following conditions:
  • Any of the following processes is found in the affected system's memory:
  • vboxservice.exe
  • vmtoolsd.exe
  • wireshark.exe
  • ollydbg.exe
  • File name is:
  • c:\insidehtm
  • c:\sample.exe
  • File is running in a virtualization application:
  • virtual_box
  • vbox
  • virtual_pc
  • virtual
  • anubis
  • qemu
  • vmware
  • Any of the following modules are found in its memory:
  • cmdvrt32.dll
  • Sxln.dll
  • SbieDll.dll
  • Sf2.dll
  • snxhk.dll
  • apimonitor-drv-x64.sys
  • apimonitor-drv-x86.sys
  • apimonitor-psn-x64.sys
  • apimonitor-psn-x86.sys
• It displays the following message:
  • 

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• bootfont.bin
• bootsect.bak
• desktop.ini
• iconcache.db
• ntdetect.com
• ntldr
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• thumbs.db
• winupas.exe
• your files are now encrypted.txt
• windows update assistant.lnk
• master.exe
• unlock.exe
• unlocker.exe

It avoids encrypting files with the following strings in their file path:

• \tor browser\
• \opera\
• \opera software\
• \mozilla\
• \mozilla firefox\
• \internet explorer\
• \google\chrome\
• \google\
• \boot\
• \application data\
• \apple computer\safari\
• \appdata\
• \all users\
• :\windows\
• :\system volume information\
• :\nvidia\
• :\intel\

It drops the following file(s) as ransom note:

• %Desktop%\Your files are now encrypted.txt

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It leaves text files that serve as ransom notes containing the following text: