Ransom.PS1.LOCKBIT.AA

它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。

新病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安装

它植入下列文件：

• %Program Data%\{4 random characters}.tmp
• %Program Data%\Ck8GvVQ9E.ico
  
• %System Root%\{8 random characters}\{random}.tmp → deleted afterwards

它添加下列进程：

• %Program Data%\{4 random characters}.tmp

它创建下列文件夹：

• %System Root%\{8 random characters}

(注意： %System Root% 是根文件夹，通常位于 C:\。它也是操作系统所在的位置。)

其他系统修改

它添加下列注册表项作为安装例程的一部分：

HKEY_LOCALMACHINE\SOFTWARE\Classes\
Ck8GvVQ9E\DefaultIcon
(Default) = %ProgramData%Ck8GvVQ9E.ico

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.Ck8GvVQ9E
(Default) = Ck8GvVQ9E

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter = 0x00000027(39)

它添加下列注册表键值作为其安装例程的一部分:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.Ck8GvVQ9E

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Ck8GvVQ9E

HKEY_LOCALMACHINE\SOFTWARE\Classes\
Ck8GvVQ9E\DefaultIcon

它通过修改下列注册表项，更改桌面壁纸：

HKEY_CURRENT_USER\Control Panel\Desktop
WallPaper = %ProgramData%\Ck8GvVQ9E.bmp

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 10

它将系统的桌面壁纸设置为下列图像：

• %Program Data%\Ck8GvVQ9E.bmp
  

进程终止

它终止在受感染的系统内存中运行的下列进程：

• agntsvc
• dbeng50
• dbsnmp
• encsvc
• excel
• firefox
• infopath
• isqlplussvc
• msaccess
• mspub
• mydesktopqos
• mydesktopservice
• notepad
• ocautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• powerpnt
• sqbcoreservice
• sql
• steam
• synctime
• tbirdconfig
• thebat
• thunderbird
• visio
• winword
• wordpad
• xfssvccon

其他详细信息

该程序执行以下操作：

• If not executed with admin rights, it will attempt relaunch itself as admin by elevating its privileges via bypassing UAC.
• It encrypts fixed, removable, and network drives
• It deletes files in recycle bin folder for removable and fixed drives
• It uses WQL to delete shadow copies
• It terminates if the machine has the following system language:
  • Arabic (Syria)
  • Armenian
  • Azeri (Cyrillic)
  • Azeri (Latin)
  • Belarusian
  • Georgian
  • Kazakh
  • Kyrgyz (Cyrillic)
  • Romanian (Moldova)
  • Russian
  • Russian (Moldova)
  • Tajik
  • Tatar
  • Turkmen
  • Ukrainian
  • Uzbek (Cyrillic)
  • Uzbek (Latin)
• It deletes services with the following strings:
  • backup
  • GxBlr
  • GxCIMgr
  • GxCVD
  • GxFWD
  • GxVss
  • memtas
  • mepocs
  • msexchange
  • sophos
  • sql
  • svc$
  • veeam
  • vss
• It deletes the following services:
  • WdBoot
  • WdFilter
  • WdNisDrv
  • WdNisSvc
  • WinDefend
  • wscsvc
  • sppsvc
  • Sense
  • SecurityHealthService
• Change the icon of encrypted file with %ProgramData%\Ck8GvVQ9E.ico