Malware Analysis Series

Static analysis: pre-encryption actions

Address: 0x14006ecf0, 0x140070c30, 0x140071d80 → 0x140071620, 0x140070e30 Callers / callees: main, once per run (not in -l mode); Restart Manager per locked file

Purpose

Prepare the host before any file is touched: avoid re-encrypting, spare system processes, and remove Volume Shadow Copies.

Walkthrough

  1. Skip-list update (FUN_14006ecf0): adds .akira and .arika to the extension skip set.
  2. Protected-PID snapshot (FUN_140070c30): WTSEnumerateProcessesW, storing the PIDs whose names are in the 20-name protected set. These PIDs are exempt from Restart Manager shutdown.
  3. Shadow-copy deletion (FUN_140071d80 → FUN_140071620):
    • Decodes a 76-byte stack string with ((0x39 − b)·0x0B) mod 0x7F into powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject".
    • Launches it through COM/WMI in ROOT\CIMV2: Win32_Process.Create, with Win32_ProcessStartup.ShowWindow = 0 (hidden) and CreateFlags = 0. PowerShell therefore appears as a child of WmiPrvSE.exe, not of the ransomware.
    • Opens the returned PID with SYNCHRONIZE and waits up to 15 s. The PID is read as a 16-bit value, so the wait silently fails for PIDs above 32767.
    • The decoded string was confirmed live. In every run the executor was forced to return (rax=0; rip=[rsp]; rsp=rsp+8), so the VM’s shadow copies survived.

Restart Manager unlocking (FUN_140070e30) runs per file, only when the file cannot be opened:

  1. RmStartSession → RmRegisterResources(file) → RmGetList.
  2. If any holder is the ransomware itself or a protected PID, it calls RmEndSession and gives up on that file.
  3. Otherwise it calls RmShutdown(session, RmForceShutdown), which kills the holders (database engines, Office, backup agents), and retries the open.

Findings

Cross-references