Ransom:MSIL/Hakbit.F!MTB

Arrival

This ransomware is delivered as an email attachment.

Mutex

The ransomware uses a hardcoded string “Global\\3747bdbf-0ef0-42d8-9234-70d68801f407” as mutex to ensure it only has one instance running.

Turns off controlled folder access

The controlled folder access feature protects valuable data from malicious apps and threats, such as ransomware. It protects data by controlling access to protected folders after checking against a list of known and trusted apps. If an app is not on the list, controlled folder access will block it from making changes to the files inside the folder.

The ransomware uses the following command to turn off the controlled folder access feature:

Powershell.exe Set-MpPreference -EnableControlledFolderAccess Disabled 

Techniques to avoid analysis and detection

To prevent attempts at analysis, this ransomware checks for the presence of a debugger and checks if the machine is running in a virtual or controlled environment. If either of these checks is found to be true, the ransomware terminates execution. In addition, it uses the following techniques to avoid detection.

• Turns off Task Manager
  To prevent users from monitoring its activity, the ransomware turns off the Task Manager through the registry.
• Stops system services
  The ransomware uses net.exe to stop anti malware and backup services. To terminate anti-malware processes, the ransomware searches for the following process names: avgidsagent, avgfws,avgtray, avgemcx, avgwdsvc, avgnsx, avgcsrvx, avgrsx, ToolbarUpdater, *mbamgui*, and *mbam*. The ransomware uses sc.exe config commands to change the configuration of service in windows service database. It also turns off various SQL-related services.
• Deletes shadow copies
  This ransomware deletes shadow copies to prevent recovery of encrypted files. Volume shadow copies are deleted using vssadmin.exe commands. Using del.exe commands, the ransomware deletes files with the following extensions: vhd, bac, bak, wbcat, bfk, set, win, and dsk. The files are deleted using the quiet mode and without user confirmation.

Lateral movement

This ransomware uses the SharpExec tool to spread across the network. It downloads SharpExec from GitHub and executes the file to spread and execute malware copy to remote machines in the network.

Encrypts and renames files

This ransomware encrypts files using AES encryption. For each encrypted file, a “Thanos-10-” marker is appended to the contents of the original file, and the extension is changed to “.crypted”.

This ransomware encrypts files with the following extension names:

To ensure it can encrypt files currently in use, this ransomware stops Microsoft Office and Oracle database processes. It copies files with .docx, .pdf, .xlsx, and .csv extensions to an FTP server before encrypting them. 

Ransom note

This ransomware creates the file HELP_ME_RECOVER_MY_FILES.txt on the desktop. The file contains the following ransom message.

SHA used in this analysis: SHA256: 79a817c6cb70d88fa07c3b8eefe1e95687ca06fbb6293dc6673359c6da6dc59b