RANSOM_SIGRUN.THEBAAH

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

It encrypts files with specific file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %All Users Profile%\{Random Characters}.lock
• {Encrypted Directory}\RESTORE-SIGRUN.html
• {Encrypted Directory}\RESTORE-SIGRUN.txt

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• iexplore.exe /C iexplore.exe SCODEF:3124 CREDAT:14337 <- Used to pop up the ransom page of the malware
• %Program Files%\Internet Explorer\iexplore.exe -nohome <- Used to Disable the homepage of Internet Explorer

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It leaves text files that serve as ransom notes containing the following:

Other System Modifications

This Ransomware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Valkyrie\
data
public = {Hex Values}

HKEY_CURRENT_USER\Software\Valkyrie\
data
KeyData = {Hex Values}

Other Details

This Ransomware does the following:

• It deletes shadow copies by executing the following command:
  • "cmd.exe" /c wmic shadowcopy delete
• It deletes the initialized copy of itself by executing the following commands:
  • "cmd.exe" /c timeout -c 5 & del "{Malware File Path}\{Malware File Name}" /f /q
• It avoids encrypting files with the following extensions:
  • .admin
  • .ani
  • .bat
  • .cab
  • .cmd
  • .cpl
  • .cur
  • .diagcab
  • .diagpkg
  • .dll
  • .drv
  • .exe
  • .hlp
  • .icl
  • .icns
  • .ico
  • .ics
  • .idx
  • .key
  • .ldf
  • .lnk
  • .mod
  • .mpa
  • .msc
  • .msp
  • .msstyles
  • .msu
  • .nomedia
  • .ocx
  • .prf
  • .rom
  • .rtp
  • .scr
  • shs
  • .sigrun
  • .sigrun_key
  • .spl
  • .sys
  • .theme
  • .themepack
• It displays the following ransom note in Internet Explorer:
  

It deletes itself after execution.

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .DIC
• .acl
• .acrodata
• .avi
• .bak
• .blog
• .bmp
• .btapp
• .cfg
• .conf
• .contact
• .crl
• .css
• .dat
• .data
• .db
• .doc
• .docx
• .dot
• .dotm
• .dotx
• .etl
• .flv
• .gif
• .glox
• .html
• .info
• .ini
• .jpg
• .js
• .json
• .jsonlz4
• .m4a
• .metadata
• .metadata-v
• .mkv
• .mp3
• .mp4
• .mpt
• .ods
• .ods
• .odt
• .one
• .ots
• .pdf
• .png
• .ppt
• .pptx
• .pst
• .rdf
• .rtf
• .sdi
• .searchconnector-ms
• .sqlite
• .srs
• .swf
• .thmx
• .timestamp
• .url
• .wim
• .wmv
• .wtv
• .xml

It avoids encrypting files with the following strings in their file name:

• Bootfont.bin
• NTDETECT.COM
• RESTORE-SIGRUN.txt
• autorun.inf
• boot.ini
• bootsect.bak
• desktop.ini
• iconcache .db
• ntldr
• ntuser.dat
• ntuser.dat.log
• thumbs.db

It avoids encrypting files found in the following folders:

• %All Users Profile%
• %Program Files%
• %ProgramData%
• %Windows%
• Boot
• IETldCache
• Local Settings
• Tor Browser

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .sigrun