Ransom.Win32.TARGETCOMP.YXCKCZ

它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。

新病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安装

它添加下列进程：

• "%System%\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /c bcdedit /set {current} recoveryenabled no
• "%Windows%\sysnative\vssadmin.exe" delete shadows /all /quiet
• taskill -f -im {Stopped Processes}
• sc delete {Deleted Services}

(注意: %Windows% 是 Windows 文件夹，通常位于 C:\WINDOWS 或 C:\WINNT。)

其他系统修改

它修改下列注册表项：

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideShutDown
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideRestart
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
PolicyManager\default\Start\
HideSignOut
value = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
shutdownwithoutlogon = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxConnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxDisconnectionTime = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\Terminal Services
MaxIdleTime = 0

它删除下列注册表键值:

HKEY_CURRENT_USER\SOFTWARE\Raccine

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\EventLog\Application\
Raccine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vssadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wmic.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
wbadmin.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
bcdedit.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
powershell.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
diskshadow.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
net.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskkill.exe

进程终止

它终止在受感染的系统内存中运行的下列进程：

• sqlserv.exe
• oracle.exe
• ntdbsmgr.exe
• sqlservr.exe
• sqlwriter.exe
• MsDtsSrvr.exe
• msmdsrv.exe
• ReportingServecesService.exe
• fdhost.exe
• fdlauncher.exe
• mysql.exe


• where (Stopped Processes}
• sqlwriter.exe
• sqlservr.exe
• msmdsrv.exe
• MsDtsSrvr.exe
• sqlceip.exe
• fdlauncher.exe
• Ssms.exe
• SQLAGENT.EXE
• fdhost.exe
• fdlauncher.exe
• sqlservr.exe
• ReportingServicesService.exe
• msftesql.exe
• pg_ctl.exe
• postgres.exe

信息窃取

它收集下列数据:

• Computer Name
• Product Name
• OS Architecture
• Application Privilege

窃取信息

它通过 HTTP POST 将收集的信息发送到下列 URL：

• http://{BLOCKED}.{BLOCKED}.191.141/QWEwqdsvsf/ap.php

其他详细信息

该程序执行以下操作：

• It encrypts files from local drives, removable drives, and network shares.
• It DOES NOT continue to routine if User Default Language ID of the system is any of the following:
• Russian (0x419)
• Kazakh (0x43F)
• Belarusian (0x423)
• Ukrainian (0x422)
• Tatar (0x444)
• It blocks any system shutdown and displays the following the message:
  • "Do NOT shutdown OR reboot your PC: this might damage your files permanently !"
• It reverts the following modified registries entries back to its default values after encryption:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDown
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRestart
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\Policies\System\shutdownwithoutlogon
• It deletes the following services {Deleted Services}:
  • MSSQLFDLauncher
  • MSSQLSERVER
  • SQLSERVERAGENT
  • SQLBrowser
  • SQLTELEMETRY
  • MsDtsServer130
  • SSISTELEMETRY130
  • SQLWriter
  • MSSQL$VEEAMSQL2012
  • SQLAgent$VEEAMSQL2012
  • MSSQL
  • SQLAgent
  • MSSQLServerADHelper100
  • MSSQLServerOLAPService
  • MsDtsServer100
  • ReportServer
  • SQLTELEMETRY$HL
  • TMBMServer
  • MSSQL$PROGID
  • MSSQL$WOLTERSKLUWER
  • SQLAgent$PROGID
  • SQLAgent$WOLTERSKLUWER
  • MSSQLFDLauncher$OPTIMA
  • MSSQL$OPTIMA
  • SQLAgent$OPTIMA
  • ReportServer$OPTIMA
  • msftesql$SQLEXPRESS
  • postgresql-x64-9.4