Ransom_RYUK.THHBAAI
Trojan Horse (Norton) ; Trojan.GenericKD.31173680 (Bitdefender)
Windows
Threat Type: Ransomware
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
It drops files as ransom note.
TECHNICAL DETAILS
Arrival Details
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Ransomware drops the following files:
- %System Root%\Users\Public\PUBLIC
- %System Root%\Users\Public\UNIQUE_ID_DO_NOT_REMOVE
- %System Root%\Users\Public\window.bat <- Used to delete shadow copies
- %System Root%\Users\Public\{Random 5 Hex}.exe -> varies depending on the system architecture
- %System Root%\Users\Public\sys
(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)
Autostart Technique
This Ransomware adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
svchos = %System Root%\Users\Public\{Random 5 Hex}.exe
Process Termination
This Ransomware terminates the following processes if found running in the affected system's memory:
- zoolz.exe
- agntsvc.exe
- dbeng50.exe
- dbsnmp.exe
- encsvc.exe
- excel.exe
- firefoxconfig.exe
- infopath.exe
- isqlplussvc.exe
- msaccess.exe
- msftesql.exe
- mspub.exe
- mydesktopqos.exe
- mydesktopservice.exe
- mysqld.exe
- mysqld-nt.exe
- mysqld-opt.exe
- ocautoupds.exe
- ocomm.exe
- ocssd.exe
- onenote.exe
- oracle.exe
- outlook.exe
- powerpnt.exe
- sqbcoreservice.exe
- sqlagent.exe
- sqlbrowser.exe
- sqlservr.exe
- sqlwriter.exe
- steam.exe
- synctime.exe
- tbirdconfig.exe
- thebat.exe
- thebat64.exe
- thunderbird.exe
- visio.exe
- winword.exe
- wordpad.exe
- xfssvccon.exe
- tmlisten.exe
- PccNTMon.exe
- CNTAoSMgr.exe
- Ntrtscan.exe
- mbamtray.exe
Other Details
This Ransomware does the following:
- Injects to all running processes except for the following:
- explorer.exe
- csrss.exe
- lsaas.exe
- Deletes shadow copy
- Executes the following to stop the following services:
- net stop \"Acronis VSS Provider\" /y
- net stop \"Enterprise Client Service\" /y
- net stop \"Sophos Agent\" /y
- net stop \"Sophos AutoUpdate Service\" /y
- net stop \"Sophos Clean Service\" /y
- net stop \"Sophos Device Control Service\" /y
- net stop \"Sophos File Scanner Service\" /y
- net stop \"Sophos Health Service\" /y
- net stop \"Sophos MCS Agent\" /y
- net stop \"Sophos MCS Client\" /y
- net stop \"Sophos Message Router\" /y
- net stop \"Sophos Safestore Service\" /y
- net stop \"Sophos System Protection Service\" /y
- net stop \"Sophos Web Control Service\" /y
- net stop \"SQLsafe Backup Service\" /y
- net stop \"SQLsafe Filter Service\" /y
- net stop \"Symantec System Recovery\" /y
- net stop \"Veeam Backup Catalog Data Service\" /y
- net stop AcronisAgent /y
- net stop AcrSch2Svc /y
- net stop Antivirus /y
- net stop ARSM /y
- net stop BackupExecAgentAccelerator /y
- net stop BackupExecAgentBrowser /y
- net stop BackupExecDeviceMediaService /y
- net stop BackupExecJobEngine /y
- net stop BackupExecManagementService /y
- net stop BackupExecRPCService /y
- net stop BackupExecVSSProvider /y
- net stop bedbg /y
- net stop DCAgent /y
- net stop EPSecurityService /y
- net stop EPUpdateService /y
- net stop EraserSvc11710 /y
- net stop EsgShKernel /y
- net stop FA_Scheduler /y
- net stop IISAdmin /y
- net stop IMAP4Svc /y
- net stop macmnsvc /y
- net stop masvc /y
- net stop MBAMService /y
- net stop MBEndpointAgent /y
- net stop McAfeeEngineService /y
- net stop McAfeeFramework /y
- net stop McAfeeFrameworkMcAfeeFramework /y
- net stop McShield /y
- net stop McTaskManager /y
- net stop mfemms /y
- net stop mfevtp /y
- net stop MMS /y
- net stop mozyprobackup /y
- net stop MsDtsServer /y
- net stop MsDtsServer100 /y
- net stop MsDtsServer110 /y
- net stop MSExchangeES /y
- net stop MSExchangeIS /y
- net stop MSExchangeMGMT /y
- net stop MSExchangeMTA /y
- net stop MSExchangeSA /y
- net stop MSExchangeSRS /y
- net stop MSOLAP$SQL_2008 /y
- net stop MSOLAP$SYSTEM_BGC /y
- net stop MSOLAP$TPS /y
- net stop MSOLAP$TPSAMA /y
- net stop MSSQL$BKUPEXEC /y
- net stop MSSQL$ECWDB2 /y
- net stop MSSQL$PRACTICEMGT /y
- net stop MSSQL$PRACTTICEBGC /y
- net stop MSSQL$PROFXENGAGEMENT /y
- net stop MSSQL$SBSMONITORING /y
- net stop MSSQL$SHAREPOINT /y
- net stop MSSQL$SQL_2008 /y
- net stop MSSQL$SYSTEM_BGC /y
- net stop MSSQL$TPS /y
- net stop MSSQL$TPSAMA /y
- net stop MSSQL$VEEAMSQL2008R2 /y
- net stop MSSQL$VEEAMSQL2012 /y
- net stop MSSQLFDLauncher /y
- net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
- net stop MSSQLFDLauncher$SBSMONITORING /y
- net stop MSSQLFDLauncher$SHAREPOINT /y
- net stop MSSQLFDLauncher$SQL_2008 /y
- net stop MSSQLFDLauncher$SYSTEM_BGC /y
- net stop MSSQLFDLauncher$TPS /y
- net stop MSSQLFDLauncher$TPSAMA /y
- net stop MSSQLSERVER /y
- net stop MSSQLServerADHelper100 /y
- net stop MSSQLServerOLAPService /y
- net stop MySQL80 /y
- net stop MySQL57 /y
- net stop ntrtscan /y
- net stop OracleClientCache80 /y
- net stop PDVFSService /y
- net stop POP3Svc /y
- net stop ReportServer /y
- net stop ReportServer$SQL_2008 /y
- net stop ReportServer$SYSTEM_BGC /y
- net stop ReportServer$TPS /y
- net stop ReportServer$TPSAMA /y
- net stop RESvc /y
- net stop sacsvr /y
- net stop SamSs /y
- net stop SAVAdminService /y
- net stop SAVService /y
- net stop SDRSVC /y
- net stop SepMasterService /y
- net stop ShMonitor /y
- net stop Smcinst /y
- net stop SmcService /y
- net stop SMTPSvc /y
- net stop SNAC /y
- net stop SntpService /y
- net stop sophossps /y
- net stop SQLAgent$BKUPEXEC /y
- net stop SQLAgent$ECWDB2 /y
- net stop SQLAgent$PRACTTICEBGC /y
- net stop SQLAgent$PRACTTICEMGT /y
- net stop SQLAgent$PROFXENGAGEMENT /y
- net stop SQLAgent$SBSMONITORING /y
- net stop SQLAgent$SHAREPOINT /y
- net stop SQLAgent$SQL_2008 /y
- net stop SQLAgent$SYSTEM_BGC /y
- net stop SQLAgent$TPS /y
- net stop SQLAgent$TPSAMA /y
- net stop SQLAgent$VEEAMSQL2008R2 /y
- net stop SQLAgent$VEEAMSQL2012 /y
- net stop SQLBrowser /y
- net stop SQLSafeOLRService /y
- net stop SQLSERVERAGENT /y
- net stop SQLTELEMETRY /y
- net stop SQLTELEMETRY$ECWDB2 /y
- net stop SQLWriter /y
- net stop SstpSvc /y
- net stop svcGenericHost /y
- net stop swi_filter /y
- net stop swi_service /y
- net stop swi_update_64 /y
- net stop TmCCSF /y
- net stop tmlisten /y
- net stop TrueKey /y
- net stop TrueKeyScheduler /y
- net stop TrueKeyServiceHelper /y
- net stop UI0Detect /y
- net stop VeeamBackupSvc /y
- net stop VeeamBrokerSvc /y
- net stop VeeamCatalogSvc /y
- net stop VeeamCloudSvc /y
- net stop VeeamDeploymentService /y
- net stop VeeamDeploySvc /y
- net stop VeeamEnterpriseManagerSvc /y
- net stop VeeamMountSvc /y
- net stop VeeamNFSSvc /y
- net stop VeeamRESTSvc /y
- net stop VeeamTransportSvc /y
- net stop W3Svc /y
- net stop wbengine /y
- net stop WRSVC /y
- net stop MSSQL$VEEAMSQL2008R2 /y
- net stop SQLAgent$VEEAMSQL2008R2 /y
- net stop VeeamHvIntegrationSvc /y
- net stop swi_update /y
- net stop SQLAgent$CXDB /y
- net stop SQLAgent$CITRIX_METAFRAME /y
- net stop \"SQL Backups\" /y
- net stop MSSQL$PROD /y
- net stop \"Zoolz 2 Service\" /y
- net stop MSSQLServerADHelper /y
- net stop SQLAgent$PROD /y
- net stop msftesql$PROD /y
- net stop NetMsmqActivator /y
- net stop EhttpSrv /y
- net stop ekrn /y
- net stop ESHASRV /y
- net stop MSSQL$SOPHOS /y
- net stop SQLAgent$SOPHOS /y
- net stop AVP /y
- net stop klnagent /y
- net stop MSSQL$SQLEXPRESS /y
- net stop SQLAgent$SQLEXPRESS /y
- net stop wbengine /y
- net stop kavfsslp /y
- net stop KAVFSGT /y
- net stop KAVFS /y
- net stop mfefire /y
It deletes itself after execution.
Ransomware Routine
This Ransomware avoids encrypting files found in the following folders:
- Windows
- Mozilla
- Chrome
- $Recycle.Bin
- AhnLab
It drops the following file(s) as ransom note:
- {Encrypted Folder}\RyukReadMe.txt
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Restart in Safe Mode
Step 4
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- svchos = %System Root%\Users\Public\{Random 5 Hex}.exe
- svchos = %System Root%\Users\Public\{Random 5 Hex}.exe
Step 5
Search and delete this file
- %System Root%\Users\Public\PUBLIC
- %System Root%\Users\Public\UNIQUE_ID_DO_NOT_REMOVE
- %System Root%\Users\Public\window.bat <- Used to delete shadow copies
- %System Root%\Users\Public\{Random 5 Hex}.exe -> varies depending on the system architecture
- %System Root%\Users\Public\sys
Step 6
Restart in normal mode and scan your computer with your Trend Micro product for files detected as Ransom_RYUK.THHBAAI. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 7
Restore encrypted files from backup.
Step 8
Scan your computer with your Trend Micro product to delete files detected as Ransom_RYUK.THHBAAI. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Did this description help? Tell us how we did.