How to Remove HHMM Ransomware

What is HHMM Ransomware?

HHMM ransomware is a dangerous file locker type of virus that encrypts the infected user’s files leaving it unusable. It is a new variant of the STOP/DJVU malware group that is created to exploit weakness on a user’s computer system and demand a hefty ransom money in exchange for the recovery and decryption of the files they encrypted.

Since there are many people who have important documents and files in their devices, those who are infected with HHMM ransomware do not have a choice but to pay for the ransom demanded by the cyber attackers in return for their valuable data.

Image of HHMM Ransomware
Screenshot of HHMM Ransomware Files

Most of the new variants of this unruly file locker virus are impossible to decrypt independently and even some experts are still having difficulties in finding a recovery for these encrypted files that is why most people are resorting to the only option which is to pay the ransom which is to pay the ransom.

Once it enters the computer system, it will perform many malicious activities that will harm your computer such as making changes to computer preferences and functions. More importantly it could disable the built-in antivirus system (Windows Defender) and other applications that may detect it as a threat.

Still not all ransomware viruses have the ability to do such actions on a computer, but still, everyone should still be alert not to download anything suspicious since it may lead to the installation of malware such as HHMM ransomware.

Another thing to keep in mind is that these type of malware often comes with a data stealer virus that can gather information within the computer such as:

  • Login details
  • Screenshots
  • Bank accounts
  • Browser history
  • Cookies.

Anything that can be found within the computer, it can be stolen by such a malware so if you are infected by HHMM ransomware or any other type of malicious threat, it is essential to keep your accounts in check.

Being one of the targets of a dangerous malware like HHMM ransomware is very destructive to a computer system and it’s network connected devices. Since it can also move from one pc to another through internet connection. If an infected device is connected to a network, then the malware could spread through other devices connected to the same network.

That is why when a computer is compromised, it is best to disconnect it from the network as soon as possible or at least boot it into safe mode with networking.

In order to give you a brief understanding of this particular malware, here is a summary of the threat:

Name HHMM
Extension .HHMM
Type of Malware Ransomware, File Locker
Malware Group STOP/DJVU
Attacker’s Email manager@time2mail.ch & supportsys@airmail.cc
Ransom Amount $490 – 980 via Cryptocurrency (Bitcoin)
Ransom Note _readme.txt
Symptoms – The .HHMM extension will be appended to the files on the computer leaving it useless and unable to open.
– Sometimes, additional malware is also deployed into the system such as data stealers and keyloggers to track the user’s session, history and login information.

The Purpose of HHMM Ransomware

A Ransomware virus is a type of malware that encrypts files on infected computers and demands a ransom payment in order to decrypt them. The ransom payments are typically made in Bitcoin or other cryptocurrencies, and the ransomware operators usually claim that they will not release the files until the ransom is paid.

The HHMM ransomware operators can make an enormous amount of money by encrypting large numbers of files and demanding high ransom payments. In some cases, the files that are encrypted can be quite valuable, and therefore ransom can be demanded at a high price.

Once a certain individual pays for the ransom as instructed by the attackers, they are given a decryption key to be used to restore their files. The decryption key is a unique digital code that unlocks files that have been encrypted by the ransomware virus.

Still, a successful ransom transaction and decryption is not always what happens in the case of a ransomware infection. It is not simply right to trust the very individuals that encrypted the files in the first place. Since doing so may also result in the opposite and do additional damage being done to your computer and may even result in the data being lost altogether.

There have also been some cases where the decryption tool provided to them turns out to be another encryptor which made their files much harder to recover. Secondly, this will only give the person who is holding your files more money and will not help you in any way.

How does the malware spread?

Almost every other type of computer virus have the same way of entering a device. They do not work upon initial download but their malicious actions will start to function after the execution of the file.

Normally, a user cannot obtain and a malicious file if they are careful of what they are browsing be it a website or reading an email. Here are the main ways where HHMM ransomware and other malicious threats could possibly be obtained:

howdoesmalwarespread

Spam email attachments: The most common and widely used strategy. It deceives the intended recipient into downloading malicious software that is attached to the attackers’ email. The files are either bundled together or disguised as documents, movies, and voicemails in the attachments.

The attacker will most likely make the attached file intriguing and interesting so that the victim will most likely open it. If you are receiving emails with attachments from unknown and suspicious sources, make sure to scan the contents before opening it.

Drive-by Downloads: It occurs when a person visits an infected website that has been injected with a malicious script that causes a random piece of software to be downloaded. Malicious hackers can then use these flaws to obtain unauthorized access to targets’ systems once they’ve been clicked.

Drive-by downloads are commonly associated with the installation of adware or potentially bundled programs (pups), but they have also been linked to the infection of users by dangerous ransomware.

Torrent Files: Torrent files are used by millions of pirates all over the world to obtain pirated movies and records, as well as cracked versions of premium software. Since then, cyber thieves have used the torrent community to propagate their dangerous software.

Torrents, particularly .exe files, are almost certainly infected. So, if you’re downloading from a torrent site, it’s worth checking the file extension because it’s usual to find that a pirated movie or music is contaminated with a virus if it’s in the.exe format.

In most cases, a user who have obtained HHMM ransomware will not have the slightest chance of opening the file. Even though it is to be an executable program (.exe) your web browser will most likely block the download of this harmful file.

Addition to that, Windows Defender would have flag it as a harmful program and will take action to remove it due to Windows Real Time Protection being enabled. On the slim chance that the threat was not detected and therefore executed, it is going to be a disaster for the computer system.

How does the ransomware work?

Once the malware is initiated, it will start on doing malicious actions on the victim’s computer. One of the first thing it would do is to disable the antivirus system inside the machine so it could do it’s actions without having to deal with the computer’s protection.

In short, it will make the system completely vulnerable to any type of malware and cyber criminals have a very good advantage to a computer without even the slightest protection. HHMM ransomware will also make changes into the computer’s system such as the host file and the registry files. It takes advantage of adding registry entries to Windows system locations so that the malware will still persist even after a reset of the computer.

After these actions, the ransomware virus will now scan the computer system for valuable files such as videos and documents. Some of the files that are typically encrypted are financial documents, business papers and important family pictures.

After scanning the system for files, it will then encrypt the files with the .HHMM to make the file useless and unable to be opened. Once the encryption of files are finished, the ransomware will leave behind a note (_readme.txt) stating that it demands $490 in Bitcoin for the decryption of the files and the amount will be doubled after 72 hours.

The use of crypto payments are commonly used by malware operators to prevent being tracked by the government. Alongside with the note, they will also leave a link for a demonstration of the file decryption and will give you the chance of decrypting 1 sample file for free as a proof that their decryption tool is working. (HHMM ransom note is as shown below)

Image of Example Ransom Note

ATTENTION!

Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-6Ti2DxXR3I
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
manager@time2mail.ch

Reserve e-mail address to contact us:
supportsys@airmail.cc

Your personal ID:
*********************************

I have been infected, what should I do?

If have been recently infected by HHMM ransomware, it is important to have safety measures. We also highly suggest that you remove the malware from the system as soon as possible to prevent further harm.

Do not think carelessly that once the file encryption is finished, the malware will also cease to function because it does not end there. Any new files that is added into the pc will be encrypted as well due to the “Time Trigger Task” that HHMM ransomware has set on the Task Scheduler application.

Here is how to remove the Time Trigger Task:

In order to get rid of it, open Task Scheduler by pressing Windows Key+R and type taskmgr.exe then enter.

Task Manager

Once the application opens up, click the Task Scheduler Library on the left side panel then find Time Trigger Task from the triggers. Once you see it, press right click and delete.

task scheduler

Now that the trigger is deleted, it will prevent HHMM ransomware from encrypting new files that comes into the computer.

Then again, the encryption may have stopped from triggering but the malware is still in the system. Before removing the malicious threat completely, it is essential to boot into Safe Mode first. It is helpful to run it when troubleshooting a problem within the computer.

Here is how to boot into Safe Mode with Networking:

In order to boot into Safe Mode, first open system configuration by pressing Windows Key + R button then type “msconfig.exe“.

msconfig

Once the System Configuration window appears, click Boot next to General then check the Safe Boot from Boot options. Below that, tick the Network option to allow internet within the Safe Mode then click apply, once everything is done and the computer should be restarted into safe mode.

system config

Below this section, we have provided a detailed procedure on how to remove HHMM ransomware as well as some possible ways to decrypt the infected files. Although it is important to note that new ransomware variants are very much unlikely to be decrypted.

Before that, we suggest that you do one last precaution before starting the removal of the virus. The last step to take before proceeding is to backup the infected files first to avoid further damage during the step by step process.

Data loss is very critical especially during a ransomware attack, in case important files are encrypted, people who do daily backups could easily pull a recent one and everything would be back to normal. Still on the case of not having a backup, the encrypted files should at least have another copy just in case the files become irreparable when something goes wrong.

backup

One of the best way to keep a backup would be through an online cloud backup services such as Dropbox and IDrive. It is convenient to have an online backup because the data can be accessed and transferred easily with any device as long as it has internet connection.

Addition to that is has built-in security that would detect if you are uploading or transferring files that are infected with malware. Another way of storing a backup would be the traditional way of having a USB flash drive.

Still it is worth to note that you should transfer files while on Safe Mode and scan your files for viruses before transferring them over to the flash drive. After completely copying the files, detach the USB stick and proceed with the step by step procedure.

HHMM Ransomware Removal Instructions

This procedure will assist you in removing HHMM ransomware as well as any dangers related to the malware infection. You can rest assured that the information provided below has been tried and tested.

Verified Icon
Our team has recently tested this procedure and has confirmed that it is still working and up-to-date. Learn More

Step 1: Remove the Virus with Malwarebytes

When dealing with malware, it is much better to rely on an antivirus application because it is much easier to utilize, especially because not everyone on the internet is adept in technology.

One of the most powerful anti-malware tools available is Malwarebytes Anti-Malware. They have some of the best threat detection tools, ensuring that any malicious malware on your computer is completely removed.

Remove HHMM with Malwarebytes

To download the application while in safe mode, you must have networking allowed to use the internet. Unless you have Malwarebytes installed on your computer already, please follow the instructions below:

Download Malwarebytes

1 Visit the official anti-malware website or click the button above to download the most up-to-date version of the software that best suits the requirements of your computer. You will also be getting a 14-day trial of the premium program as you download the application for the first time.

Malwarebytes Website Image

2 When prompted to choose between personal and organizational use, click the personal option unless you are downloading it within your company. From then on, follow the installation procedure given on your computer's setup screen.

malwarebyetsoption

3 After following the software setup instructions, wait for the application to finish installing.

malwarerbytes install

4 Once the application is installed, run your first computer scan and wait for it to finish.

mlbscanning

5 All discovered malware on the computer will be displayed on the screen, and you can eliminate them by pressing the "quarantine" button.

mlbscan

Once the process is complete, HHMM Ransomware, as well as any other malicious threats found on the computer, should be removed. Activating  Malwarebytes Real-Time Protection is also recommended, as it will secure your computer and detect potential threats as soon as they surface.


Step 2: Decrypt Files with Emsisoft

As previously stated, decrypting .HHMM files can be difficult due to the constant rise of new strains of this malware, making it difficult for cybersecurity experts to develop a decryptor. Furthermore, the STOP/DJVU ransomware group has released new versions since 2019, which encrypt data with a random four-digit letter for each variant.

The Emsisoft STOP/DJVU decryption tool can only decrypt older varieties of the virus at the moment, and newer variants will have to wait. In addition to that, only those infected with the offline key will be able to decrypt their data, while those infected with the online key will be unable to do so unless they have a previous backup.

To test if your files are decryptable, follow the instructions below on how to install and use the application:

1 Go to the official website (click here) and click the download button on the page to get the program file.

Download STOP DJVU Decryptor Image

2 Click the arrow icon beside the downloaded file then select Show in folder.

Show in Folder

3 Once the downloads folder shows, right-click the setup file then run as administrator. When the user account control screen pops up, click Yes.

Run as Administrator

4 Read the license agreement's terms as well as the disclaimer before using the program, then proceed to the next step.Emsisoft License Terms

5 Once the application starts, select the folder wherein the infected files are stored. Then click decrypt and wait for the program to finish the process.

Emsisoft Decryptor

After the program finishes the decryption process, a message will show whether it has successfully decrypted the files or not. If the program was unsuccessful in decrypting the infected files, refer to the Results tab to know the reason why the decryption was not possible. The following messages as well as what it means are shown below:

  • Unable to decrypt a file: It means that decryption is unsuccessful because there are no data about the malware within their servers.
  • This ID appears to be an online ID, decryption is impossible: An online ID is a unique key that is impossible and cannot be decrypted by the program and the only way is to pay for the ransomware attacker's demands.
  • This ID appears to be an offline ID. Decryption may be possible in the future: Since it is a new variant of the STOP/DJVU group, a file recovery may be possible in the future once enough keys are fetched that match the one you have. It is important to note that it may take months and even years for a decryption to be possible.

If you cannot wait that long to recover your files, you may resort to using other alternative recovery tools that are available out there.

Alternative Decryption Tools:

Here are alternative programs you may use to restore your files from a ransomware attack. Although the tools mentioned below may be difficult to use, there are numerous tutorials available online explaining how to utilize them. Note that the tools mentioned below do not guarantee the decryption of .HHMM files.

ShadowExplorer Application

Shadow Explorer

ShadowExplorer is a file recovery program that allows you to recover prior versions of files that have been altered or overwritten. The application accesses the location in which the documents or files are located and retrieves them from there.

(Click here to download)

For your information, Windows saves a copy of the files you updated with its restore points, but you won't be able to access them until you have the feature turned on. Restoring your data with software like ShadowExplorer, on the other hand, can be a lifesaver especially when facing a ransomware virus.

In a matter of seconds, the application will display all of the recovered copies. Whatever sort of file you need to restore, ShadowExplorer will find the overwritten copies in any format. This application is extremely useful since it could simply pull up a backup copy of the infected data and get it back. It would be as if it wasn't infected at all, as long as there is a shadow copy of the files it could do just that.

PhotoRec Application

PhotoRec

Photo Rec is primarily a photo recovery program. It allows you to recover photographs from a variety of digital devices, including laptops, video cameras, mobile phones, external drives, and more.

The tool can also recover corrupted photos, making it suitable for occasions such as ransomware attacks.

(Click here to download)

Since corrupted photos can be lost or unrecoverable. PhotoRec comes in handy here. The application is a digital picture recovery utility that allows you to recover photographs and images from a variety of devices, even if they have been corrupted by system or file damage.

The program is open-source and free. It recovers missing files from a system using text-based data recovery algorithms. However, do note that this application cannot ensure that your infected photos will be completely decrypted.


Step 3: Final Precautionary Measures (Optional)

Before returning to normal Windows mode, make sure the computing device is safe and malware-free. You don't want another ransomware attack to occur once you reboot.

Cybercriminals utilize a variety of methods to obtain access to their victims' devices; individuals who have recently been hacked should ensure that their device's security is tight to prevent hackers from gaining access again.

Here are a few things to do to keep the computer safe against another ransomware attack or any other dangerous threats.

Controlled folder access should be used if you're running Windows 10 or 11. It helps safeguard sensitive data from malicious threats, such as the HHMM ransomware.

Turning it on will limit access to the specified folders to just those applications that have been permitted to open them. Please follow the procedures below to enable controlled folder access unless you already have it enabled.

1 Open the Windows Start Menu and search Windows Security then click the application.

windows security e1652510542794

2 Once the Windows Security application shows up, click on Virus & threat protection from one of the options shown.

vt protectio

3 Scroll down and find the Ransomware protection section, then click the Manage ransomware protection as shown.

manage ransomware protectio

4 Turn on the Controlled folder access by toggling it On.

controlled folder access

5 From the Protected folders button, you can add the folders you want protected and only apps with permission are only allowed to access it.

add a folder

Although not every file on the computer can be safeguarded, all valuable files should be retained and placed in a protected folder. Malware like HHMM ransomware won't be able to infect and encrypt files within a protected folder thanks to the Controlled folder access functionality.

It's a very helpful feature to have, but you should be cautious about which apps you provide access to protected folders. There may be viruses disguised as genuine programs that could try and take advantage of this, therefore be cautious when permitting programs and double-check that they are valid.

One of the most important precautions, according to many computer experts, is to periodically back up your files so that you have a copy in case of a ransomware attack. The damage would be lessened if files were backed up to a cloud or a USB stick, but many individuals do not make it a routine to back up their files.

After getting hit by ransomware, one would undoubtedly learn their lesson and perform regular backups.  Cloud storage is one of the best ways to back up your files because it is accessible from anywhere with an internet connection.

Fortunately, OneDrive has a computer file backup feature, and you should back up your files now as a precaution in case of another attack. OneDrive is preinstalled for Windows 10 and later versions, so if you are using an older system, you have to download the application first (click here).

1 To access One Drive, open the Windows Start Menu and search OneDrive then click the application.

one drive

2 Once the OneDrive application/website opens up, fill in the required information needed to sign up if you haven't done it yet.

email

3 Backup the files that are in Desktop, Pictures, and Documents by making sure there is a check mark on the upper right of their icons. Click Continue to proceed with the next steps and finish the introduction.

backup your folder

4 As you can see, OneDrive is a folder and if you want to add more items to safeguard, simply copy and paste that item into this designated folder. Files that are backed up will have a checkmark beside them. Those with the cloud icon mean that they are only available when there is an internet connection.

One Drive Folder

Once your files are safe, it will greatly limit the chance of being damaged during another malware attack since you can just pull a backup from the OneDrive cloud.

Now you may use your computer once again and boot back to normal mode. In addition to that, you may read below some safety tips on how to browse the internet safely and prevent encountering malicious threats.

Some Internet Safety Tips

  • Websites with distinctive domain extensions should be avoided. Domain extensions other than .com, .org, .net, and .edu should be avoided because most infected websites have very distinct TLDs, always check the last section of a domain to make sure you're on a safe site unless it has been reputable for a long time.
  • Never download software or programs from unknown sources. This is one of the most popular ways for adware and other malware to infiltrate your computer. Download only from recognized and legal sources. To be secure, avoid torrent downloads and cracked software download sites, as the files will almost always contain viruses.
  • One of the most reliable ways to be safe online is to use a firewall. It protects users from potentially hazardous websites by acting as a first line of protection. It keeps intruders out of the user's network and device. In today's world, a firewall will protect a user from the risks that lurk on the huge internet.
  • Anti-virus software must be kept up to date. These programs should always be updated on a computer since hundreds of new malware threats are produced every day that aim to infect the machine's weaknesses. Antivirus updates contain the most recent files needed to combat new threats and protect your computer.
  • Only visit websites with a secure connection. Since HTTP connections do not encrypt the data they receive, they are not considered secure. Entering personal information like email addresses, phone numbers, and passwords on a website that uses an HTTP connection is hazardous since your information could be stolen. Websites that use HTTPS connections, on the other hand, are more secure because data is encrypted and attackers are less likely to obtain access to information shared within the site.