Ransom.MSIL.HAKUNAMATATA.THAAFBD

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system and executes them:

• %AppDataLocal%\rundll32.exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Readme-ID-{Computer Name} = %AppDataLocal%\rundll32.exe

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

• %User Temp%\{9 Random Characters}.jpg
  

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• CNTAoSMgr
• code
• dbeng50
• dbsnmp
• encsvc
• excel
• firefoxconfig
• infopath
• isqlplussvc
• mbamtray
• msaccess
• msftesql
• mspub
• mydesktopqos
• mydesktopservice
• mysqld
• mysqld-nt
• mysqld-opt
• Ntrtscan
• ocautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• PccNTMon
• powerpnt
• ProcessHacker
• sqbcoreservice
• sqlagent
• sqlbrowser
• sqlservr
• sqlwriter
• steam
• synctime
• tbirdconfig
• thebat
• thebat64
• thunderbird
• tmlisten
• VBoxSVC
• VirtualBoxVM
• visio
• vmplayer
• winword
• wordpad
• wps
• xfssvccon
• zoolz

Other Details

This Ransomware does the following:

• It checks if its process file path and file name is %AppDataLocal%\rundll32.exe
  • If not, it checks if %AppDataLocal%\rundll32.exe already exists
    • If it exists, it will delete the file and drops a copy of itself as %AppDataLocal%\rundll32.exe.
    • If not, it will drop a copy of itself as %AppDataLocal%\rundll32.exe.
• It checks if the size of the file to encypt is less than or greater than 524,288 bytes
  • If it is less than 524,288 bytes, it will encrypt the whole file.
  • If it is greater than 524,288 bytes, it will use intermittent encryption - First 131,072 bytes, another 131,072 bytes from the middle of the file, and the last 131,072 bytes
• It empties the recycle bin
• It encrypts its targeted files twice.

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• autorun.inf
• boot.ini
• bootfont.bin
• bootmgfw.efi
• bootmgr
• bootmgr.efi
• desktop.ini
• iconcache.db
• ntuser.dat
• Ntuser.ini
• Readme-ID-{Computer Name}.txt
• thumbs.db

It avoids encrypting files with the following strings in their file path:

• c:\windows
• c:\users\all users
• c:\programdata
• c:\program files (x86)
• c:\users\default
• c:\program files
• c:\perflogs
• c:\windows.old

It avoids encrypting files found in the following folders:

• $recycle.bin
• $windows.~bt
• $windows.~ws
• appdata
• documents and settings
• intel
• mozilla
• PerfLogs
• perflogs
• program files
• program files (x86)
• programdata
• system volume information
• windows
• windows.old
• windows.old.old

It appends the following extension to the file name of the encrypted files:

• .crypt

It drops the following file(s) as ransom note:

• {Encrypted Directory}\Readme-ID-{Computer Name}.txt
  

It avoids encrypting files with the following file extensions:

• .386
• .adv
• .ani
• .bin
• .cab
• .cmd
• .com
• .cpl
• .crypt
• .cur
• .deskthemepack
• .diagcab
• .diagcfg
• .diagpkg
• .dll
• .drv
• .exe
• .hlp
• .hta
• .icl
• .icns
• .ico
• .ics
• .idx
• .key
• .ldf
• .lnk
• .lock
• .mod
• .mpa
• .msc
• .msi
• .msp
• .msstyles
• .msu
• .nls
• .nomedia
• .ocx
• .pdb
• .prf
• .ps1
• .rom
• .rtp
• .scr
• .shs
• .spl
• .sys
• .theme
• .themepack
• .wpx