RANSOM_HIDDENTEARSMILY.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Start Menu%\Programs\Startup\HTDecryptor.exe
• %Desktop%\HTDecryptor.exe
• %All Users Profile%\Startup\HTDecryptor.exe
• %All Users Profile%\Start Menu\HTDecryptor.exe
• %All Users Profile%\Desktop\HTDecryptor.exe
• %Program Files%\HTDecryptor.exe
• %User Profile%\Documents\HTDecryptor.exe
• %User Profile%\Pictures\HTDecryptor.exe
• %User Profile%\Music\HTDecryptor.exe
• %User Profile%\Videos\HTDecryptor.exe
• %Start Menu%\Programs\Startup\message.exe - ransom note
• %All Users Profile%\Startup\message.exe - ransom note

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Start Menu%\Programs\Startup\HTCryptor.exe

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Crypt = %Start Menu%\Programs\Startup\HTCryptor.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Message = %All Users Profile%\Startup\message.exe

Other Details

This Ransomware does the following:

• It disables the firewall by executing the following command/s:
  • cmd.exe "netsh firewall set opmode disable"

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .3dm
• .3ds
• .3g2
• .3gp
• .7z
• .accdb
• .ai
• .aif
• .asf
• .asp
• .aspx
• .avi
• .bak
• .bin
• .bmp
• .c
• .cbr
• .cer
• .cfm
• .class
• .cpp
• .crdownload
• .cs
• .csr
• .css
• .csv
• .cue
• .dat
• .db
• .dbf
• .dds
• .deb
• .dmg
• .doc
• .docx
• .dtd
• .dwg
• .dxf
• .eps
• .fla
• .flv
• .ged
• .gif
• .gz
• .h
• .htm
• .html
• .ics
• .iff
• .indd
• .iso
• .java
• .jpg
• .js
• .jsp
• .key
• .keychain
• .log
• .lua
• .m
• .m3u
• .m4a
• .m4v
• .max
• .mdb
• .mdf
• .mid
• .mov
• .mp3
• .mp4
• .mpa
• .mpg
• .msg
• .msi
• .obj
• .odt
• .pages
• .part
• .pct
• .pdb
• .pdf
• .php
• .pkg
• .pl
• .png
• .pps
• .ppt
• .pptx
• .ps
• .psd
• .py
• .rar
• .rm
• .rpm
• .rss
• .rtf
• .sdf
• .sh
• .sitx
• .sln
• .sql
• .srt
• .svg
• .swf
• .swift
• .tar
• .tar.gz
• .tax2014
• .tax2015
• .tex
• .tga
• .thm
• .tif
• .tiff
• .tmp
• .toast
• .torrent
• .txt
• .vb
• .vcd
• .vcf
• .vcxproj
• .vob
• .wav
• .wma
• .wmv
• .wpd
• .wps
• .xcodeproj
• .xhtml
• .xlr
• .xls
• .xlsx
• .xml
• .yuv
• .zip
• .zipx

It encrypts files found in the following folders:

• %User Profile%\Pictures
• %User Profile%\Recent
• %User Profile%\Music
• %User Profile%\Videos
• %User Profile%\Documents
• %User Profile%\Favorites
• %All Users Profile%\Documents
• %All Users Profile%\Pictures
• %All Users Profile%\Music
• %All Users Profile%\Videos
• %All Users Profile%\Desktop

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It renames encrypted files using the following names:

• {original filename and extension}.locked

NOTES:
It displays the following as its ransom note: