Ransom.Win32.LOCKBIT.YXCGD
Trojan-Ransom.BlackMatter(IKARUS), Ransom:Win32/Lockbit.STB(MICROSOFT)
Windows
恶意软件类型:
Ransomware
有破坏性?:
没有
加密?:
In the Wild:
是的
概要
它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。
技术详细信息
新病毒详细信息
It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
安装
它植入下列文件:
- %ProgramData%\HLJkNskOq.ico
- %ProgramData%\HLJkNskOq.bmp
它添加下列进程:
- if -safe is used:
- bcdedit /set {current} safeboot network
它向下列进程中注入代码:
- svchost.exe
自启动技术
它添加下列注册表项,在系统每次启动时自行执行:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce
*{random} = {malware path}\{malware name}
其他系统修改
它添加下列注册表项:
HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension}
hScreen = {screen height}
HKEY_LOCAL_MACHINE\SOFTWARE\{appended ransomware extension}
wScreen = {screen width}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AutoAdminLogon = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultUserName = Administrator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultDomainName = {Computer name}
它通过修改下列注册表项,更改桌面壁纸:
HKEY_CURRENT_USER\Control Panel\Desktop
WallPaper = %ProgramData%\HLJkNskOq.bmp
HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 10
它将系统的桌面壁纸设置为下列图像:
进程终止
它终止在受感染的系统上运行的下列服务:
- backup
- GxBlr
- GxCIMgr
- GxCVD
- GxFWD
- GxVss
- memtas
- mepocs
- msexchange
- sophos
- sql
- svc$
- veeam
- vss
它终止在受感染的系统内存中运行的下列进程:
- agntsvc
- dbeng50
- dbsnmp
- encsvc
- excel
- firefox
- infopath
- isqlplussvc
- msaccess
- mspub
- mydesktopqos
- mydesktopservice
- notepad
- ocautoupds
- ocomm
- ocssd
- onenote
- oracle
- outlook
- powerpnt
- sqbcoreservice
- sql
- steam
- synctime
- tbirdconfig
- thebat
- thunderbird
- visio
- winword
- wordpad
- xfssvccon
其他详细信息
它添加下列注册表键值:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
HLJkNskOq\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
HLJkNskOq
该程序执行以下操作:
- If not executed with admin rights, it will attempt relaunch itself as admin by elevating its privileges via bypassing UAC
- It encrypts fixed, removable and network drives
- It deletes files in recycle bin folder for removable and fixed drives
- It uses WQL to delete shadow copies
- It terminates if the machine has the following system language:
- Arabic (Syria)
- Armenian (Armenia)
- Azerbaijani (Cyrillic Azerbaijan)
- Azerbaijani (Latin Azerbaijan)
- Belarusian (Belarus)
- Georgian (Georgia)
- Kazakh (Kazakhstan)
- Kyrgyz (Kyrgyzstan)
- Russian (Moldova)
- Russian (Russia)
- Tajik (Cyrillic Tajikistan)
- Tatar (Russia) Romanian (Moldova)
- Turkmen (Turkmenistan)
- Ukranian (Ukraine)
- Uzbek (Cyrillic Uzbekistan)
- Uzbek (Latin Uzbekistan)
- It deletes the following services:
- wdnissvc
- WinDefend
- wscsvc
- sppsvc
- Sense
- SecurityHealthService
- It has the capability to print the ransom note in infected machines
解决方案
Step 2
对于Windows ME和XP用户,在扫描前,请确认已禁用系统还原功能,才可全面扫描计算机。
Step 3
请注意,在执行此恶意软件/间谍软件/灰色软件期间,并非所有文件、文件夹、注册表项和条目都安装在您的计算机上。这可能是由于安装不完整或其他操作系统条件造成的。如果找不到相同的文件/文件夹/注册表信息,请继续下一步。
Step 4
重启进入安全模式
Step 5
删除该注册表值
注意事项:错误编辑Windows注册表会导致不可挽回的系统故障。只有在您掌握后或在系统管理员的帮助下才能完成这步。或者,请先阅读Microsoft文章,然后再修改计算机注册表。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- *{random} = {malware path}\{malware name}
- *{random} = {malware path}\{malware name}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HLJkNskOq\DefaultIcon
- {Default} = %ProgramData%\HLJkNskOq.ico
- {Default} = %ProgramData%\HLJkNskOq.ico
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- AutoAdminLogon = 1
- AutoAdminLogon = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- DefaultUserName = Administrator
- DefaultUserName = Administrator
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- DefaultDomainName = {Computer name}
- DefaultDomainName = {Computer name}
Step 6
删除该注册表键值
注意事项:错误编辑Windows注册表会导致不可挽回的系统故障。只有在您掌握后或在系统管理员的帮助下才能完成这步。或者,请先阅读Microsoft文章,然后再修改计算机注册表。
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HLJkNskOq\
- DefaultIcon
- DefaultIcon
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
- HLJkNskOq
- HLJkNskOq
Step 7
搜索和删除该文件
- %ProgramData%\HLJkNskOq.ico
- %ProgramData%\HLJkNskOq.bmp
- {Infected Directory}\HLJkNskOq.README.txt
Step 8
重启进入正常模式,使用亚信安全产品扫描计算机,检测Ransom.Win32.LOCKBIT.YXCGD文件 如果检测到的文件已被亚信安全产品清除、删除或隔离,则无需采取进一步措施。可以选择直接删除隔离的文件。请参阅知识库页面了解详细信息。
Step 9
从备份中还原被加密的文件。
Step 10
重置桌面壁纸