RANSOM_ARGUS.THAAABAH

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%/wallpaper.bmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It drops and executes the following files:

• %User Profile%\audiodg.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista, 7, and 8.)

It adds the following processes:

• "wmic" os get Caption /format:list

Other System Modifications

This Ransomware changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%/wallpaper.bmp

It sets the system's desktop wallpaper to the following image:

Backdoor Routine

This Ransomware connects to the following websites to send and receive information:

• http://{BLOCKED}r.info/

Information Theft

This Ransomware gathers the following data:

• Machine name
• Username
• OS Version

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• http://api.ipify.org/

It does the following:

• After encrypting files:
  • It execute the following command:
    • "%User Profile%\audiodg.exe" /accepteula -z {Drive Letter}:\
    • "%System%\bcdedit.exe" /set {default} recoveryenabled No
    • "%System%\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
    • "%System%\wbadmin.exe" DELETE SYSTEMSTATEBACKUP
    • "%System%\vssadmin.exe" delete shadows /All
    • "%System%\wbadmin.exe" DELETE BACKUP
    • "%System%\wbem\WMIC.exe" SHADOWCOPY DELETE
• It suspends the execution if it finds a running process that contains the following strings and it prompts the following:
  • ProcessHacker
  • DnSpy
  • fiddler
  • Reflector
    

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• {All Drives} ← except system drives
• %Desktop%
• %User Profile%/Pictures
• %User Profile%/Music
• %User Profile%/Videos
• %User Profile%/Recent
• %User Profile%/Personal
• %User Profile%/Documents

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista, 7, and 8.)

It avoids encrypting files with the following strings in their file name:

• ARGUS

It appends the following extension to the file name of the encrypted files:

• .ARGUS

It drops the following file(s) as ransom note:

• {encrypted file directory}/ARGUS-DECRYPT.html