#Thanos ransomware use several methods against Sandbox and VM ( debugger, check size of the disk, dlls ...). Once this done, this hide for monitoring tool that uses NtQuerySystemInformation method in downloading and executing ProcessHide binaries. 
After this kill the security solutions and change the preferences of MSE. This write the persistence by Winlogon key. This download a second binary "PAExec" for spread install the ransomware on the infrastruture and reboot the computer.
After go on safe mode, this try to bruteforce with the current password if haven't the admin rights. If works, add a new admin and use this password for spread the infrastructure. This ping for get the hosts are up by ICMP and ARP scans.
This select the key for deviate the key ( use RIPlace method for bypass anti-ransomware measures) and encrypt the disks parsed. This write the message of the note on start menu for ensure that the victim see the note.
This push an notification and show the note to the victim.
Fun fact, don't works on XP by the killswitch ( BIOS and not UEFI ?)
ref :
Full code + Key : github.com/StrangerealInt…
Thanks to @JAMESWT_MHT
cc : @demonslay335 @malwrhunterteam @JAMESWT_MHT @James_inthe_box @shotgunner101 @VK_Intel @
ref :
Full code + Key : github.com/StrangerealInt…
Thanks to @JAMESWT_MHT
cc : @demonslay335 @malwrhunterteam @JAMESWT_MHT @James_inthe_box @shotgunner101 @VK_Intel @
