Snatch Ransomware Reboots Windows in Safe Mode to Bypass Antivirus

Unlike traditional malware, the new Snatch ransomware chooses to
run in Safe Mode because in the diagnostic mode Windows operating
system starts with a minimal set of drivers and services without
loading most of the third-party startup programs, including
antivirus software.

Snatch has been active since at least the summer of 2018, but
SophosLabs researchers spotted the Safe Mode enhancement to this
ransomware strain only in recent cyber attacks against various
entities they investigated.

“SophosLabs researchers have been investigating an ongoing
series of ransomware attacks in which the ransomware executable
forces the Windows machine to reboot into Safe Mode before
beginning the encryption process,” the researchers
say.
^[1]

“The ransomware, which calls itself Snatch, sets itself up as a
service [called SuperBackupMan with the help of Windows registry] that will run during a Safe Mode boot.”

“When the computer comes back up after the reboot, this time in
Safe Mode, the malware uses the Windows component net.exe to halt
the SuperBackupMan service, and then uses the Windows component
vssadmin.exe to delete all the Volume Shadow Copies on the system,
which prevents forensic recovery of the files encrypted by the
ransomware.”

What makes Snatch different and dangerous from others is that in
addition to ransomware, it’s also a data stealer. Snatch includes a
sophisticated data-stealing module, allowing attackers to steal
vast amounts of information from the target organizations.

“Snatch can run on most common versions of Windows, from 7
through 10, in 32- and 64-bit versions. The samples we’ve seen are
also packed with the open source packer UPX to obfuscate their
contents,” the researchers say.

Besides this, the attackers behind Snatch ransomware also offer
partnership opportunities to other cybercriminals and rogue
employees who possess credentials and backdoors into large
organizations and can exploit it to deploy the ransomware.

“We also found a range of otherwise legitimate tools that have
been adopted by criminals installed on machines within the target’s
network, including Process Hacker, IObit Uninstaller, PowerTool,
and PsExec. The attackers typically use them to try to disable AV
products,” the researchers say.

Coveware, a company that specializes in extortion negotiations
between attackers and ransomware victims, told Sophos that they
negotiated with the Snatch criminals “on 12 occasions between July
and October 2019 on behalf of their clients” with the ransom
payments ranging between $2,000 to $35,000 in bitcoins.

To prevent ransomware attacks, organizations are recommended not
to expose their critical services and secure ports to the public
Internet, and if required, secure them using a strong password with
multi-factor authentication.