RANSOM_CRYPSHED.TX

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops a copy of itself in the following folders using different file names:

• %ProgramData%\Windows\csrss.exe

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Client Server Runtime Subsystem = "%ProgramData%\Windows\csrss.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xVersion = "4.0.0.1"

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xi = "{ID}"

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xmode = "{mode}"

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xstate = "{state}"

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xcnt = "{encrypted files count}"

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
shst = "{number}"

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
sh2 = "{Public Key}"

It sets the system's desktop wallpaper to the following image:

Dropping Routine

This Trojan drops the following files:

• %User Temp%\ns{random}.tmp
• %User Temp%\ns{random}.tmp\System.dll
• %User Profile%\System32\xfs - list of encrypted files
• {Drive Letter}:\README{number}.txt-serves as ransom note
• %User Temp%\metamorph_flash100
• %User Temp%\jquery-ui-stars_ver-3.9.1.css
• %User Temp%\button-uqanswers.png
• %User Temp%\JcyJpqCkpCfIJRU.3mGzJUmd8lt
• %Application Data%\{random alphanumeric characters}.bmp - wallpaper (serves as ransom notice)

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan encrypts files with the following extensions:

• .edml
• .raw
• .jpg
• .jpeg
• .jpe
• .bmp
• .png
• .tif
• .tiff
• .dib
• .gif
• .svg
• .svgz
• .rle
• .tga
• .vda
• .icb
• .wbm
• .wbmp
• .jpf
• .jpx
• .jp2
• .j2k
• .j2c
• .jpc
• .avi
• .mkv
• .mov
• .mp4
• .wmv
• .3gp
• .mpg
• .mpeg
• .m4v
• .divx
• .mpv
• .m1v
• .dat
• .anim
• .m4a
• .qt
• .3g2
• .f4v
• .mkidx
• .mka
• .avs
• .vdr
• .flv
• .bin
• .mp3
• .wav
• .asx
• .pls
• .zip
• .7z
• .rar
• .tar
• .gz
• .bz2
• .wim
• .xz
• .c
• .h
• .hpp
• .cpp
• .php
• .php3
• .php4
• .php5
• .py
• .pl
• .sln
• .js
• .json
• .inc
• .sql
• .java
• .class
• .ini
• .asm
• .clx
• .tbb
• .tbi
• .tbk
• .pst
• .dbx
• .cbf
• .crypted
• .tib
• .eml
• .fld
• .vbm
• .vbk
• .vib
• .vhd
• .mtr
• .vault
• .1cd
• .dt
• .cf
• .cfu
• .mxl
• .epf
• .vrp
• .grs
• .geo
• .elf
• .lgf
• .lgp
• .log
• .st
• .pff
• .mft
• .efd
• .md
• .dmp
• .fdb
• .lst
• .fbk

It renames encrypted files using the following names:

• {random characters}=.{ID}.no_more_ransom

It sets the attributes of the following file(s) to Hidden and System:

• %Program Data%\Windows\
• %User Profile%\System32\
• %User Profile%\System32\xfs

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It does the following:

• Deletes Shadow copies
  • %System%\vssadmin.exe Delete Shadows /All /Quiet
• Installs TOR browser

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

NOTES:

It leaves the following ransom note: