Ransom.Win32.LOCKBIT.YEBGW

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

新(xīn)病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安(ān)装(zhuāng)

它植入下列文(wén)件：

• %User Temp%\{4 Hex Characters}.tmp.bmp → Used as Wallpaper.

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

它添加下列进程：

• %System%\cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
• %System%\mshta.exe %Desktop%\LockBit_Ransomware.hta {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
• %System%\cmd.exe /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "{Malware Filepath}\{Malware Filename}" & Del /f /q "{Malware Filepath}\{Malware Filename}"

(注意: %System% 是 Windows 的 system 文(wén)件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。. %Desktop% 是当前用(yòng)户的桌面，通常位于 C:\Windows\Profiles\{user name}\Desktop (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Desktop (Windows NT)、C:\Documents and Settings\{User Name}\桌面 (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\Desktop (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)

它添加下列互斥条目，确保一次只会运行一个副本：

• {D028A5BF-D028-A31F-9BF8-DBCBCB5CDB55}

自启动技(jì )术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{F068DCBF-2828-A337-9BF8-9BCB3D5CBF55} = {Malware Filepath}\{Malware Filename}.exe

其他(tā)系统修改

它添加下列注册表项：

HKEY_CURRENT_USER\Software\7D68A5BF281FF8
Private = {Hex Values}

HKEY_CURRENT_USER\Software\7D68A5BF281FF8
Public = {Hex Values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.lockbit
(Default) = Lockbit

HKEY_CLASSES_ROOT\Lockbit
(Default) = Lockbit Class

HKEY_CLASSES_ROOT\Lockbit\DefaultIcon
(Default) = %System%\{random}.ico

HKEY_CLASSES_ROOT\Lockbit\shell\
Open\Command
(Default) = %System%\mshta.exe %Desktop%\LockBit_Ransomware.hta

它通过修改下列注册表项，更改桌面壁纸：

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{4 Hex Characters}.tmp.bmp

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 2

HKEY_CURRENT_USER\Control Panel\Desktop
TileWallpaper = 0

它将系统的桌面壁纸设置為(wèi)下列图像：

进程终止

它终止在受感染的系统上运行的下列服務(wù)：

• AcronisAgent
• AcrSch2Svc
• ARSM
• backup
• BackupExecAgentAccelerator
• BackupExecAgentBrowser
• BackupExecDiveciMediaService
• BackupExecJobEngine
• BackupExecManagementService
• BackupExecRPCService
• BackupExecVSSProvider
• bedbg
• CAARCUpdateSvc
• CASAD2DWebSvc
• ccEvtMgr
• ccSetMgr
• Culserver
• dbeng8
• dbsrv12
• DefWatch
• FishbowlMySQL
• Intuit.QuickBooks.FCS
• memtas
• mepocs
• MSExchange
• MSExchange$
• msftesql-Exchange
• msmdsrv
• MSSQL
• MSSQL$
• MSSQL$KAV_CS_ADMIN_KIT
• MSSQL$MICROSOFT##SSEE
• MSSQL$MICROSOFT##WID
• MSSQL$MICROSOFT##WID
• MSSQL$SBSMONITORING
• MSSQL$SHAREPOINT
• MSSQL$VEEAMSQL2012
• MSSQLFDLauncher$SBSMONITORING
• MSSQLFDLauncher$SHAREPOINT
• MSSQLServerADHelper100
• MVArmor
• MVarmor64
• MySQL57
• PDVFSService
• QBCFMonitorService
• QBFCService
• QBIDPService
• QBVSS
• RTVscan
• SavRoam
• sophos
• sql
• sqladhlp
• SQLADHLP
• sqlagent
• SQLAgent$KAV_CS_ADMIN_KIT
• SQLAgent$SBSMONITORING
• SQLAgent$SHAREPOINT
• SQLAgent$VEEAMSQL2012
• sqlbrowser
• SQLBrowser
• Sqlservr
• SQLWriter
• stc_raw_agent
• svc$
• tomcat6
• veeam
• VeeamDeploymentService
• VeeamNFSSvc
• VeeamTransportSvc
• vmware-converter
• vmware-usbarbitator64
• VSNAPVSS
• vss
• wrapper
• WSBExchange
• YooBackup
• YooIT
• zhudongfangyu

它终止在受感染的系统内存中(zhōng)运行的下列进程：

• 360doctor.exe
• 360se.exe
• acwebbrowser.exe
• ADExplorer.exe
• ADExplorer64.exe
• ADExplorer64a.exe
• Adobe CEF.exe
• Adobe Desktop Service.exe
• AdobeCollabSync.exe
• AdobeIPCBroker.exe
• agntsvc.exe
• AutodeskDesktopApp.exe
• Autoruns.exe
• Autoruns64.exe
• Autoruns64a.exe
• Autorunsc.exe
• Autorunsc64.exe
• Autorunsc64a.exe
• avz.exe
• axlbridge.exe
• bedbh.exe
• benetns.exe
• bengien.exe
• beserver.exe
• BrCcUxSys.exe
• BrCtrlCntr.exe
• CagService.exe
• CoreSync.exe
• Creative Cloud.exe
• Culture.exe
• dbeng50.exe
• dbsnmp.exe
• Defwatch.exe
• DellSystemDetect.exe
• dumpcap.exe
• encsvc.exe
• EnterpriseClient.exe
• excel.exe
• fbguard.exe
• fbserver.exe
• fdhost.exe
• fdlauncher.exe
• GDscan.exe
• GlassWire.exe
• GWCtlSrv.exe
• Helper.exe
• httpd.exe
• infopath.exe
• InputPersonalization.exe
• isqlplussvc.exe
• j0gnjko1.exe
• java.exe
• koaly-exp-engine-service.exe
• msaccess.exe
• MsDtSrvr.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld.exe
• node.exe
• notepad.exe
• notepad++.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• onenote.exe
• ONENOTEM.exe
• oracle.exe
• outlook.exe
• powerpnt.exe
• ProcessHacker.exe
• Procexp.exe
• Procexp64.exe
• procexp64a.exe
• procmon.exe
• procmon64.exe
• procmon64a.exe
• pvlsvr.exe
• QBDBMgr.exe
• QBDBMgrN.exe
• QBIDPService.exe
• qbupdate.exe
• QBW32.exe
• Raccine.exe
• Raccine_x86.exe
• RaccineElevatedCfg.exe
• RaccineSettings.exe
• RAgui.exe
• raw_agent_svc.exe
• RdrCEF.exe
• RTVscan.exe
• sam.exe
• Simply.SystemTrayIcon.exe
• SimplyConnectionManager.exe
• sqbcoreservice.exe
• sqlbrowser.exe
• sqlmangr.exe
• Sqlservr.exe
• Ssms.exe
• steam.exe
• supervise.exe
• sync-taskbar.exe
• synctime.exe
• sync-worker.exe
• Sysmon.exe
• Sysmon64.exe
• SystemExplorer.exe
• SystemExplorerService.exe
• SystemExplorerService64.exe
• tbirdconfig.exe
• tcpview.exe
• tcpview64.exe
• tcpview64a.exe
• tdsskiller.exe
• TeamViewer.exe
• TeamViewer_Service.exe
• thebat.exe
• thunderbird.exe
• TitanV.exe
• tomcat6.exe
• Totalcmd.exe
• Totalcmd64.exe
• tv_w32.exe
• tv_x64.exe
• VeeamDeploymentSvc.exe
• visio.exe
• vsnapvss.exe
• vxmon.exe
• wdswfsafe.exe
• winword.exe
• WireShark.exe
• wordpad.exe
• wsa_service.exe
• wxServer.exe
• wxServerView.exe
• xfssvccon.exe
• ZhuDongFangYu.exe

其他(tā)详细信息

它添加下列注册表键值:

HKEY_CURRENT_USER\Software\7D68A5BF281FF8

该程序执行以下操作(zuò)：

• It has the capability to print the ransom note in infected machines.
• It encrypts files found in the following drive types:
  • Fixed drive
  • Removable drive
  • Network drive
  • RAM Disks