Ransom.Win64.EDANAV.THCOCBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• "cmd.exe" /c ping 127.0.0.1 -n 3 > Nul & Del /f /q {Malware File Name} →if the parameter -sd is used
• "bcdedit" /set (default) safeboot network →if the parameter -sm is used
• "shutdown" -r →if the parameter -sm is used

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control
ServicesPipeTimeout = 0x05265c00(86400000)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
nevada
(Default) = Service

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
WinDefend

Other Details

This Ransomware adds the following registry keys:

HKLM\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
nevada

It does the following:

• It accepts the following arguments:
  • -help → display help option
  • -file {file path} → encrypt selected file
  • -dir {directory} → encrypt selected directory
  • -sd → enable self-deletion after encryption
  • -sc → delete shadow copies
  • -lhd → load hidden drives
  • -nd → find and encrypt network shares
  • -sm → enable safe mode
• It checks the User's Default language. If one of the following then it terminates itself:
  • 419 → Russian (Russia)
  • 443 → Uzbek - Latin (Uzbekistan)
  • 440 → Kyrgyz - Cyrillic (Kyrgyztan)
  • 423 → Belarusian (Belarus)
  • 42C → Azeri (Azerbaijan)
  • 428 → Tajik (Tajikistan)
  • 42B → Armenian (Armenia)
  • 444 → Tatar (Russia)
  • 819 → Russian (Moldova)
• It creates a pipe named:
  • \.\pipe\__rust_anonymous_pipe1__.[Process ID].[Random Numbers]
• It displays activity logs in the console.
• It is rust compiled

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• Windows
• Program Files
• Program Files (x86)
• AppData
• Programdata
• System volume information

It appends the following extension to the file name of the encrypted files:

• .NEVADA

It drops the following file(s) as ransom note:

• {Encrypted Directory}\readme.txt
  

It avoids encrypting files with the following file extensions:

• exe
• ini
• dll
• url
• lnk
• scr