SentinelOne Vs. Spook Ransomware – Kill and Quarantine

Watch how SentinelOne kills and quarantines Spook Ransomware. Spook ransomware emerged onto the scene in late September/early October 2021. The group, mirroring the manifestos of others, boasts “very strong (AES) encryption” along with the threat of leaking victim data to the public. Spook malware has the ability to encrypt target machines without requiring internet connectivity. Encryption of a full disk can occur within just a few minutes, at which point the ransom note is displayed on the desktop (RESTORE_FILES_INFO.HTA) along with numerous other system notifications.

The malware also makes a number of changes to ensure that the ransom notifications are displayed prominently after reboot (via Start Menu lnk, Reg). In addition, Spook will also attempt to terminate processes and stop services of anything that may inhibit the encryption process.
This is handled between taskill.exe and sc.exe. Additonal persistence mods are made via reg.exe and schtasks.exe.

Spook maintains a blog for ‘non-compliant’ victims. The blog was made live in early October 2021. As of this writing, there are 17 victims posted to the Spook blog, from varying industries across the globe.