RANSOM_CRYSIS.L

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %System%\{Malware Filename}.exe ? (if admin)
• %Application Data%\{Malware Filename}.exe ? (if non-admin)

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\syncronize_{random 6 characters}A
• Global\syncronize_{random 6 characters}U

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Malware Filename}.exe = %System%\{Malware Filename}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Malware Filename}.exe = %Application Data%\{Malware Filename}.exe

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %Application Data%\Microsoft\Windows\Start Menu\Programs\Startup\{Malware Filename}.exe
• %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup\{Malware Filename}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
%System%\Info.hta = "mshta.exe "%System%\Info.hta""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
%Application Data%\Info.hta = "mshta.exe "%Application Data%\Info.hta""

Process Termination

This Ransomware terminates the following services if found on the affected system:

• FirebirdGuardianDefaultInstance
• FirebirdServerDefaultInstance
• sqlwriter
• mssqlserver
• sqlserveradhelper

It terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• 1c8.exe
• 1cv77.exe
• outlook.exe
• postgres.exe
• mysqld-nt.exe
• mysqld.exe
• sqlserver.exe

Other Details

This Ransomware does the following:

• It deletes shadow copies by executing the following command:
  • vssadmin delete shadows /all /quiet
• It executes the following commands:
  • mode con cp select=1251
• It avoids encrypting files/directories with the following strings:
  • %Windows%
  • boot.ini
  • bootfont.bin
  • ntldr
  • ntdetect.com
  • Io.sys
  • Info.hta
  • FILES_ENCRYPTED.txt
  • {Malware Filename}.exe
• It encrypts files in all fixed, remote and removable drives.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .id-{ID}.[{BLOCKED}TC@{BLOCKED}k.li].java

It drops the following file(s) as ransom note:

• %Application Data%\Info.hta
• %System%\Info.hta
• %User Startup%\Info.hta
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
• {Public User Desktop}\FILES ENCRYPTED.txt
• {All Drives}\FILES ENCRYPTED.txt
• %Desktop%\FILES ENCRYPTED.txt

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

NOTES:

This ransomware displays the following ransom notes after encrypting the target files: