Ocomm.exe mysqld.exe mysqld-nt.exe mysqld-opt.exe dbeng50.exe sqbcoreservice.exe excel.exe Ocautoupds.exe agntsvc.exe agntsvc.exe agntsvc.exe encsvc.exe firefoxconfig.exe tbirdconfig.exe Synctime.exe agntsvc.exe mydesktopqos.exe isqlplussvc.exe xfssvccon.exe mydesktopservice.exe Msftesql.exe sqlagent.exe sqlbrowser.exe sqlservr.exe sqlwriter.exe oracle.exe ocssd.exe dbsnmp.exe The caller function calls sub_403E72 first, using a debugger we can see the list of the processes returned. The blacklisted processes are passed to this function as an argument, we can go a step back using Xrefs to know what the blacklisted processes are. The ransomware loops through running processes to search and kill blacklisted ones at sub_4032FA Main_function creates a bunch of threads for different tasks like traversing and encrypting files, killing blacklisted processes and so on.

The winMain function just calls main_function. Now Let’s fire up IDA and see how it goes. The encrypted files are renamed to Going Deep

If we let the ransomware run for while we can see it drops its note in two formats. Using Autoruns from sysinternals we can see that it adds a value to the registry and copies itself to the startup folder to maintain persistence, which means that it can encrypt new files. If we accept it and use ProcessHacker we can see that it spawns another copy of itself with the elevated privileges.

If we run ransomware we can see that it asks for administrator privileges. There is not much readable strings here which might indicate the strings are somewhat obfuscated. We can see some interesting imports with different functionalities like: file traversal, crypto stuff, file read&write, processes traversal, …

Pestudio malware analysis