Ransom.Win32.BLACKMATTER.THGOCBA

它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。它开始执行然后再删除。

新病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安装

它植入下列文件：

• used as wallpaper:
  • %ProgramData%\{appended ransomware extension}.bmp

它添加下列进程：

• if -safe is used:
  • bcdedit /set {current} safeboot network

它添加下列互斥条目，确保一次只会运行一个副本：

• Global\{Generated hash based on GUID}

自启动技术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce
*{random} = {malware path}\{malware name}

其他系统修改

它添加下列注册表项：

HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension}
hScreen = {screen height}

HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension}
wScreen = {screen width}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AutoAdminLogon = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultUserName = Administrator

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultDomainName = {Computer name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultPassword = {random string}

它通过修改下列注册表项，更改桌面壁纸：

HKEY_CURRENT_USER\Control Panel\Desktop
WallPaper = %ProgramData%\{appended ransomware extension}.bmp

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 10

它将系统的桌面壁纸设置为下列图像：

进程终止

它终止在受感染的系统上运行的下列服务：

• mepocs
• memtas
• veeam
• svc$
• backup
• sql
• vss

它终止在受感染的系统内存中运行的下列进程：

• encsvc
• thebat
• mydesktopqos
• xfssvccon
• firefox
• infopath
• winword
• steam
• synctime
• notepad
• ocomm
• onenote
• mspub
• thunderbird
• agntsvc
• sql
• excel
• powerpnt
• outlook
• wordpad
• dbeng50
• isqlplussvc
• sqbcoreservice
• oracle
• ocautoupds
• dbsnmp
• msaccess
• tbirdconfig
• ocssd
• mydesktopservice
• visio

信息窃取

它收集下列数据:

• Machine GUID
• Computer name
• Hostname
• Username
• Domain
• OS Architecture
• Language
• Disk information (free size, disk size)
• Total number of files
• Total number of encrypted files

窃取信息

它通过 HTTP POST 将收集的信息发送到下列 URL：

• http://{BLOCKED}hacks.com/{encrypted gathered information}
• http://{BLOCKED}den.com/{encrypted gathered information}

其他详细信息

它添加下列注册表键值:

HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension} → deleted after execution

该程序执行以下操作：

• If not executed with admin rights, it will relaunch itself as admin
• It encrypts fixed, removable and network drives
• It deletes files in recycle bin folder for removable and fixed drives
• 它使用 WQL 来删除快照副本
• It attempts logging in to infected machine using the following credentials:
  • Username: {BLOCKED}er@{BLOCKED}p.com
    Password: {BLOCKED}er
  • Username: {BLOCKED}h@{BLOCKED}p.com
    Password: {BLOCKED}19
  • Username: {BLOCKED}r@{BLOCKED}p.com
    Password: {BLOCKED}**