The Gentlemen Ransomware

The Gentlemen Ransomware has written registry keys within HKLM and HKCU to gain persistence device wide and to have redundancy. The Gentlemen Ransomware has added registry keys to maintain persistence through reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GupdateS /t REG_SZ /d "<malware_path>" /f and reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GupdateU /t REG_SZ /d "<malware_path>" /f.^[1][4]

The Gentlemen Ransomware has utilized the domain’s NETLOGON share to distribute the malicious payload to all domain-joined systems.^[2]

The Gentlemen Ransomware has utilized PowerShell to execute commands.^[1][2][4][3] The Gentlemen Ransomware has also leveraged PowerShell cmdlets to disable real-time monitoring and set exclusions.^[4]

The Gentlemen Ransomware has executed service commands using sc.exe to modify configurations and set the service to "start-auto" to run automatically when the system restarted to include fdrespub, fdPHost, SSDPSRV and upnphost.^[1][4]

The Gentlemen Ransomware has copied malware executables, such as PsExec.exe, to the local C:\Temp directory.^[1][4][3] The Gentlemen Ransomware had also enabled a hidden SMB share pointed at the C:\Temp folder to allow anonymous access.^[1][4] The Gentlemen Ransomware has also consolidated data in C:\ProgramData\data\.^[2]

The Gentlemen Ransomware has the ability to change the system’s desktop wallpaper using a bitmap image file stored as %TEMP%\gentlemen.bmp.^[1][4]

The Gentlemen Ransomware has modified windows firewall rules to allow for discovery actions using netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes and using the PowerShell command -Command Get-NetFirewall Rule -DisplayGroup "Network Discovery" | Enable-NetFirewallRule.^[1][4] The Gentlemen Ransomware has also modified firewall rules to allow remote desktop access using the command netsh firewall set service type remotedesktop mode enable or netsh advfirewall firewall set rule group="remote desktop" new enable=Yes.^[2][4] The Gentlemen Ransomware has also deactivated Windows firewall rules using the command netsh advfirewall set allprofiles state off. The Gentlemen Ransomware has disabled the Windows Firewall settings using the PowerShell cmdlet powershell -Command Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False.^[4]

The Gentlemen Ransomware has utilized a wipe feature that writes 64 MB chunks of data to a targeted drive to exhaust all free space and overwrites previously deleted file content, reducing recovery capabilities.^[4]

The Gentlemen Ransomware has the ability to modify Group Policy on victim Domain Controllers through a PowerShell script that enables simultaneous ransomware detonation on every computer in domain.^[2][4]

The Gentlemen Ransomware has modified the ownership and access control settings to ensure it has unrestricted write access to target file paths prior to encryption. The Gentlemen Ransomware has leveraged the takeown, icacls and attrib commands to modify permissions on files and folders.^[1][4]

The Gentlemen Ransomware has created hidden SMB share folder named "share$" that allowed anonymous access.^[1][4]

The Gentlemen Ransomware has deleted PowerShell command history for all users by targeting the command history file located in C:/Users/*/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadline/ConsoleHost_History.txt.^[1]

The Gentlemen Ransomware has deleted preexisting scheduled tasks and created malicious versions of the same named task to execute automatically at system start to include tasks named UpdateSystem and UpdateUser.^[1] The Gentlemen Ransomware has also leveraged naming conventions that mimic legitimate VMware services.^[4]

The Gentlemen Ransomware has enabled Remote Desktop Protocol within victim environments.^[2]

The Gentlemen Ransomware has leveraged crontab to launch the ransomware after a 60-second delay upon reboot using echo '@reboot sleep 60 && /bin/.vmware-authd <original_argv>' | crontab - 2>/dev/null.^[4]

The Gentlemen Ransomware has executed service commands using sc.exe to modify configurations and allow victim hosts to be visible on the local network.^[1]