Ransom.Win32.ICRYPT.AG
W32/DelShad.EOUMLKU!tr.ransom (Fortinet), Trojan.Win32.DelShad.mu (Kaspersky), Trojan:Win32/Tiggre!plock (Microsoft)
Windows
Threat Type: Ransomware
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
Downloaded from the Internet, Dropped by other malware
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
It encrypts files found in specific folders. It drops files as ransom note.
TECHNICAL DETAILS
278,528 bytes
EXE
13 Jun 2019
Displays message/message boxes, Encrypts files
Arrival Details
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Ransomware drops the following copies of itself into the affected system and executes them:
- {Legitimate file path}/{malware file}.exe <- it modifies the legitimate application to be its dropped copy.
Other Details
This Ransomware does the following:
- Execute the following command to take ownership of a file:
- %System%\takeown.exe /F %System%\{legitimate file}.exe
- %System%\icacls.exe %System%\{legitimate file}.exe /reset
- After encrypting file:
- It restore/ delete the drop copy of itself and back to original legitimate file.
- It deletes itself after execution.
- Executes the following commands to gather information:
- %System%\arp.exe -a
- %System%\nslookup.exe {Infected Default Gateway}
- %System%\nslookup.exe 225.255.255.255
- %System%\nslookup.exe 239.255.255.250
- %System%\net.exe view igmp.mcast.net
- Creates a process to execute the following command to delete the shadow copy of the infected system:
- %System%\vssadmin.exe Delete Shadows /All /Quiet
- Executes the following commands:
- %Application Data%\WXZuMM9D:bin %User Temp%\{Malware Filename}.exe
- %System%\diskshadow.exe /s %User Temp%\{random character}.tmp <- script file containing diskshadow commands
- %System%\diskshadow.exe /s %Windows%\TEMP\{random character}.tmp <- script file containing diskshadow commands
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)
It deletes itself after execution.
Ransomware Routine
This Ransomware encrypts files found in the following folders:
- {All Drive}:\
- %Desktop%
- %Favorites%
- %Program Files%
- %ProgramData%
- %User Profile%
- %User Profile%\Documents
- %User Profile%\Downloads
- %User Profile%\Music
- %User Profile%\Pictures
- %User Profile%\Videos
- %User Profile%\Links
- %User Profile%\Contacts
- %User Profile%\Searches
(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Favorites% is the current user's Favorites folder, which is usually C:\Documents and Settings\{user name}\Favorites on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Favorites on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)
It avoids encrypting files with the following strings in their file name:
- .exe
- .dll
It avoids encrypting files with the following strings in their file path:
- Windows
- Microsoft
It appends the following extension to the file name of the encrypted files:
- .0riz0n
It drops the following file(s) as ransom note:
- {encrypted file}.{file extension}.0riz0n_readme
SOLUTION
9.850
15.230.05
12 Jul 2019
15.231.00
13 Jul 2019
Step 1
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Identify and terminate files detected as Ransom.Win32.ICRYPT.AG
- Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
- If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
- If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.
Step 4
Search and delete this file
- {encrypted file}.{file extension}.0riz0n_readme
Step 5
Scan your computer with your Trend Micro product to delete files detected as Ransom.Win32.ICRYPT.AG. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Step 6
Restore encrypted files from backup.
Did this description help? Tell us how we did.