Ransom.Win32.TARGETCOMP.YXCKCZ

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它添加下列进程：

• "%System%\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /c bcdedit /set {current} recoveryenabled no
• "%Windows%\sysnative\vssadmin.exe" delete shadows /all /quiet
• taskill -f -im {Stopped Processes}
• sc delete {Deleted Services}

(注意: %Windows% 是 Windows 文(wén)件夹，通常位于 C:\WINDOWS 或 C:\WINNT。)

其他(tā)系统修改

它修改下列注册表项：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideShutDown
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideRestart
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideSignOut
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
shutdownwithoutlogon = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0

它删除下列注册表键值:

HKEY_CURRENT_USER\SOFTWARE\Raccine

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\EventLog\Application\
Raccine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vssadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wmic.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wbadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bcdedit.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
powershell.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
diskshadow.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
net.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskkill.exe

进程终止

它终止在受感染的系统内存中(zhōng)运行的下列进程：

• sqlserv.exe
• oracle.exe
• ntdbsmgr.exe
• sqlservr.exe
• sqlwriter.exe
• MsDtsSrvr.exe
• msmdsrv.exe
• ReportingServecesService.exe
• fdhost.exe
• fdlauncher.exe
• mysql.exe


• where (Stopped Processes}
• sqlwriter.exe
• sqlservr.exe
• msmdsrv.exe
• MsDtsSrvr.exe
• sqlceip.exe
• fdlauncher.exe
• Ssms.exe
• SQLAGENT.EXE
• fdhost.exe
• fdlauncher.exe
• sqlservr.exe
• ReportingServicesService.exe
• msftesql.exe
• pg_ctl.exe
• postgres.exe

信息窃取

它收集下列数据:

• Computer Name
• Product Name
• OS Architecture
• Application Privilege

窃取信息

它通过 HTTP POST 将收集的信息发送到下列 URL：

• http://{BLOCKED}.{BLOCKED}.191.141/QWEwqdsvsf/ap.php

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It encrypts files from local drives, removable drives, and network shares.
• It DOES NOT continue to routine if User Default Language ID of the system is any of the following:
• Russian (0x419)
• Kazakh (0x43F)
• Belarusian (0x423)
• Ukrainian (0x422)
• Tatar (0x444)
• It blocks any system shutdown and displays the following the message:
  • "Do NOT shutdown OR reboot your PC: this might damage your files permanently !"
• It reverts the following modified registries entries back to its default values after encryption:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Policies\System\shutdownwithoutlogon
• It deletes the following services {Deleted Services}:
  • MSSQLFDLauncher
  • MSSQLSERVER
  • SQLSERVERAGENT
  • SQLBrowser
  • SQLTELEMETRY
  • MsDtsServer130
  • SSISTELEMETRY130
  • SQLWriter
  • MSSQL$VEEAMSQL2012
  • SQLAgent$VEEAMSQL2012
  • MSSQL
  • SQLAgent
  • MSSQLServerADHelper100
  • MSSQLServerOLAPService
  • MsDtsServer100
  • ReportServer
  • SQLTELEMETRY$HL
  • TMBMServer
  • MSSQL$PROGID
  • MSSQL$WOLTERSKLUWER
  • SQLAgent$PROGID
  • SQLAgent$WOLTERSKLUWER
  • MSSQLFDLauncher$OPTIMA
  • MSSQL$OPTIMA
  • SQLAgent$OPTIMA
  • ReportServer$OPTIMA
  • msftesql$SQLEXPRESS
  • postgresql-x64-9.4