Ransom.Win32.BLACKMATTER.THGOCBA

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

新(xīn)病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安(ān)装(zhuāng)

它植入下列文(wén)件：

• used as wallpaper:
  • %ProgramData%\{appended ransomware extension}.bmp

它添加下列进程：

• if -safe is used:
  • bcdedit /set {current} safeboot network

它添加下列互斥条目，确保一次只会运行一个副本：

• Global\{Generated hash based on GUID}

自启动技(jì )术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce
*{random} = {malware path}\{malware name}

其他(tā)系统修改

它添加下列注册表项：

HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension}
hScreen = {screen height}

HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension}
wScreen = {screen width}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AutoAdminLogon = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultUserName = Administrator

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultDomainName = {Computer name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultPassword = {random string}

它通过修改下列注册表项，更改桌面壁纸：

HKEY_CURRENT_USER\Control Panel\Desktop
WallPaper = %ProgramData%\{appended ransomware extension}.bmp

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 10

它将系统的桌面壁纸设置為(wèi)下列图像：

进程终止

它终止在受感染的系统上运行的下列服務(wù)：

• mepocs
• memtas
• veeam
• svc$
• backup
• sql
• vss

它终止在受感染的系统内存中(zhōng)运行的下列进程：

• encsvc
• thebat
• mydesktopqos
• xfssvccon
• firefox
• infopath
• winword
• steam
• synctime
• notepad
• ocomm
• onenote
• mspub
• thunderbird
• agntsvc
• sql
• excel
• powerpnt
• outlook
• wordpad
• dbeng50
• isqlplussvc
• sqbcoreservice
• oracle
• ocautoupds
• dbsnmp
• msaccess
• tbirdconfig
• ocssd
• mydesktopservice
• visio

信息窃取

它收集下列数据:

• Machine GUID
• Computer name
• Hostname
• Username
• Domain
• OS Architecture
• Language
• Disk information (free size, disk size)
• Total number of files
• Total number of encrypted files

窃取信息

它通过 HTTP POST 将收集的信息发送到下列 URL：

• http://{BLOCKED}hacks.com/{encrypted gathered information}
• http://{BLOCKED}den.com/{encrypted gathered information}

其他(tā)详细信息

它添加下列注册表键值:

HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension} → deleted after execution

该程序执行以下操作(zuò)：

• If not executed with admin rights, it will relaunch itself as admin
• It encrypts fixed, removable and network drives
• It deletes files in recycle bin folder for removable and fixed drives
• 它使用(yòng) WQL 来删除快照副本
• It attempts logging in to infected machine using the following credentials:
  • Username: {BLOCKED}er@{BLOCKED}p.com
    Password: {BLOCKED}er
  • Username: {BLOCKED}h@{BLOCKED}p.com
    Password: {BLOCKED}19
  • Username: {BLOCKED}r@{BLOCKED}p.com
    Password: {BLOCKED}**