Ransom.Win32.LOCKBIT.EOD
Windows
恶意软件类型:
Ransomware
有破坏性?:
没有
加密?:
是的
In the Wild:
是的
概要
它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。
技术详细信息
新病毒详细信息
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
安装
它向下列进程中注入代码:
- explorer.exe
- notepad.exe
自启动技术
它植入下列文件:
- %ProgramData%\Ck8GvVQ9E.ico
其他系统修改
它添加下列注册表项作为安装例程的一部分:
HKEY_LOCALMACHINE\SOFTWARE\Classes\
Ck8GvVQ9E\DefaultIcon
(Default) = %ProgramData%Ck8GvVQ9E.ico
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.Ck8GvVQ9E
(Default) = Ck8GvVQ9E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter = 0x00000027(39)
它添加下列注册表键值作为其安装例程的一部分:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.Ck8GvVQ9E
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Ck8GvVQ9E
HKEY_LOCALMACHINE\SOFTWARE\Classes\
Ck8GvVQ9E\DefaultIcon
进程终止
它终止在受感染的系统内存中运行的下列进程:
- agntsvc
- calc
- dbeng50
- dbsnmp
- encsvc
- excel
- firefox
- infopath
- isqlplussvc
- msaccess
- mspub
- mydesktopqos
- mydesktopservice
- notepad
- ocautoupds
- ocomm
- ocssd
- onedrive
- onenote
- oracle
- outlook
- powerpnt
- sqbcoreservice
- sql
- steam
- synctime
- tbirdconfig
- thebat
- thunderbird
- visio
- winword
- wordpad
- wuauclt
- xfssvccon
其他详细信息
它要求下列额外的组件正常运行:
- LBB.bin → Encrypted Lockbit Ransomware
该程序执行以下操作:
- If not executed with admin rights, it will attempt relaunch itself as admin by elevating its privileges via bypassing UAC.
- It encrypts fixed, removable and network drives
- It deletes files in recycle bin folder for removable and fixed drives
- It uses WQL to delete shadow copies
- It terminates if the machine has the following system language:
- Arabic (Syria)
- Armenian
- Azerbaijani (Cyrillic)
- Azerbaijani (Latin)
- Belarusian
- Georgian
- Kazakh
- Kyrgyz (Cyrillic)
- Romanian (Moldova)
- Russian
- Russian (Moldova)
- Tajik
- Tatar
- Turkmen
- Ukrainian
- Uzbek (Cyrillic)
- Uzbek (Latin)
- It deletes services with the following strings:
- backup
- GxBlr
- GxCIMgr
- GxCVD
- GxFWD
- GxVss
- memtas
- mepocs
- msexchange
- sophos
- sql
- svc$
- veeam
- vss
- It deletes the following services:
- WdBoot
- WdFilter
- WdNisDrv
- WdNisSvc
- WinDefend
- wscsvc
- sppsvc
- Sense
- SecurityHealthService
- Change the icon of encrypted file with %ProgramData%\Ck8GvVQ9E.ico
解决方案
Step 1
对于Windows ME和XP用户,在扫描前,请确认已禁用系统还原功能,才可全面扫描计算机。
Step 2
搜索和删除该文件
- %ProgramData%\Ck8GvVQ9E.ico
Step 3
删除该注册表键值
注意事项:错误编辑Windows注册表会导致不可挽回的系统故障。只有在您掌握后或在系统管理员的帮助下才能完成这步。或者,请先阅读Microsoft文章,然后再修改计算机注册表。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
- .Ck8GvVQ9E
- .Ck8GvVQ9E
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
- Ck8GvVQ9E
- Ck8GvVQ9E
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ck8GvVQ9E\
- DefaultIcon
- DefaultIcon
Step 4
删除该注册表值
注意事项:错误编辑Windows注册表会导致不可挽回的系统故障。只有在您掌握后或在系统管理员的帮助下才能完成这步。或者,请先阅读Microsoft文章,然后再修改计算机注册表。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.Ck8GvVQ9E
- (Default) = Ck8GvVQ9E
- (Default) = Ck8GvVQ9E
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ck8GvVQ9E\DefaultIcon
- (Default) = %ProgramData%Ck8GvVQ9E.ico
- (Default) = %ProgramData%Ck8GvVQ9E.ico
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio
- Explorer GlobalAssocChangedCounter = 0x00000027(39)
- Explorer GlobalAssocChangedCounter = 0x00000027(39)
Step 5
使用趋势科技产品扫描计算机,并删除检测到的Ransom.Win32.LOCKBIT.EOD文件 如果检测到的文件已被趋势科技产品清除、删除或隔离,则无需采取进一步措施。可以选择直接删除隔离的文件。请参阅知识库页面了解详细信息。