Ransom.Win32.AGENDA.YPEFR

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

新病毒详细信息

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

安装

它植入下列文件：

• %Temp%\QLOG\ThreadId(Number).LOG → logs execution status
  

它添加下列进程：

• "cmd" /C fsutil behavior set SymlinkEvaluation R2R:1
• "cmd" /C fsutil behavior set SymlinkEvaluation R2L:1
• "cmd" /C net use
• "cmd" /C wmic service where name='vss' call ChangeStartMode Manual
• "cmd" /C net start vss
• "cmd" /C vssadmin.exe delete shadows /all /quiet
• "cmd" /C net stop vss
• "cmd" /C wmic service where name='vss' call ChangeStartMode Disabled
• "powershell" $logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName ; ForEach ( $l in $logs | Sort | Get-Unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)}
• "powershell" -Command "Import-Module ActiveDirectory ; Get-ADComputer -Filter * | Select-Object -ExpandProperty DNSHostName"
• "powershell" -Command "ServerManagerCmd.exe -i RSAT-AD-PowerShell ; Install-WindowsFeature RSAT-AD-PowerShell ; Add-WindowsCapability -Online -Name 'RSAT.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0'"

它创建下列文件夹：

• %Temp%\QLOG

(注意: %Temp% 是 Windows 的临时文件夹，通常位于 C:\WINDOWS\Temp 或 C:\WINNT\Temp。)

自启动技术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
*vxvjgf = "{Malware file path}" --password {String} --no-admin

其他系统修改

它修改下列注册表项：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLinkedConnections = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\LanmanServer\Parameters
MaxMpxCt = 65535

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\FileSystem
SymlinkRemoteToRemoteEvaluation = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\FileSystem
SymlinkRemoteToLocalEvaluation = 1

进程终止

它终止在受感染的系统上运行的下列服务：

• vmms
• mepocs
• memtas
• veeam
• backup
• vss
• sql
• msexchange
• sophos
• msexchange
• msexchange\$
• wsbexchange
• pdvfsservice
• backupexecvssprovider
• backupexecagentaccelerator
• backupexecagentbrowser
• backupexecdivecimediaservice
• backupexecjobengine
• backupexecmanagementservice
• backupexecrpcservice
• gxblr
• gxvss
• gxclmrs
• gxcvd
• gxcimgr
• gxmmm
• gxvsshwprov
• gxfwd
• sapservice
• sap
• sap\$
• sapd\$
• saphostcontrol
• saphostexec
• qbcfmonitorservice
• qbdbmgrn
• qbidpservice
• acronisagent
• veeamnfssvc
• veeamdeploymentservice
• veeamtransportsvc
• mvarmor
• mvarmor64
• vsnapvss
• acrsch2svc
• (.*?)sql(.*?)

它终止在受感染的系统内存中运行的下列进程：

• vmms
• vmwp
• vmcompute
• agntsvc
• dbeng50
• dbsnmp
• encsvc
• excel
• firefox
• infopath
• isqlplussvc
• sql
• msaccess
• mspub
• mydesktopqos
• mydesktopservice
• notepad
• ocautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• powerpnt
• sqbcoreservice
• steam
• synctime
• tbirdconfig
• thebat
• thunderbird
• visio
• winword
• wordpad
• xfssvccon
• bedbh
• vxmon
• benetns
• bengien
• pvlsvr
• beserver
• raw_agent_svc
• vsnapvss
• cagservice
• qbidpservice
• qbdbmgrn
• qbcfmonitorservice
• sap
• teamviewer_service
• teamviewer
• tv_w32
• tv_x64
• cvmountd
• cvd
• cvfwd
• cvods
• saphostexec
• saposcol
• sapstartsrv
• avagent
• avscc
• dellsystemdetect
• enterpriseclient
• veeamnfssvc
• veeamtransportsvc
• veeamdeploymentsvc
• mvdesktopservice

其他详细信息

该程序执行以下操作：

• It terminates itself if it detects that the sample is being executed within a virtual environment.
• It requires the correct input password to proceed in its intended routine.
• Impersonates the privileges of the following process:
  • wininit.exe
  • winlogon.exe
  • lsass.exe