RANSOM_CRYPTWELVE.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\wallpaper.bmp
• %Desktop%\sys.bat <-used to terminate the ransomware

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• KristinaCS

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\wallpaper.bmp

It sets the system's desktop wallpaper to the following image:

Other Details

This Ransomware does the following:

• Can perform encryption routine on all different directories found at the same time
• Exits and deletes itself only after performing all the encryption routines
• Execute the following commands usind CMD
  /C net view

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• .crypt12
• .tmp
• .sep
• .tlb
• .tbl
• .tsp
• .cmd
• .ax
• .olb
• .com
• .acm
• .edb
• .ini
• .exe
• .386
• .73u
• .8xu
• .adm
• .adml
• .admx
• .ani
• .ann
• .aos
• .asec
• .bio
• .bk2
• .blf
• .bmk
• .bud
• .cab
• .cdmp
• .chs
• .ci
• .cnt
• .cpi
• .cpl
• .cpq
• .cur
• .desklink
• .deskthemepack
• .dev
• .diagcab
• .diagcfg
• .diagpkg
• .dimax
• .dit
• .drv
• .dss
• .dyc
• .ebd
• .efi
• .evtx
• .ffa
• .ffl
• .ffo
• .ffx
• .ftg
• .fts
• .gmmp
• .grl
• .group
• .grp
• .h1s
• .hdmp
• .hhc
• .hhk
• .hiv
• .hlp
• .hpj
• .hsh
• .htt
• .icl
• .icns
• .ico
• .idi
• .ifw
• .ime
• .img3
• .inf_loc
• .ins
• .ion
• .ipod
• .itemdata-ms
• .its
• .jpn
• .kbd
• .key
• .kor
• .library-ms
• .lnk
• .log1
• .log2
• .lpd
• .manifest
• .mapimail
• .mdmp
• .mi4
• .mlc
• .mobileconfig
• .msc
• .msp
• .msstyle
• .msstyles
• .mui
• .mui_cccd5ae0
• .mum
• .mydocs
• .nb0
• .nbh
• .nfo
• .nls
• .nt
• .ntfs
• .p7b
• .pck
• .pdr
• .pfx
• .pid
• .pk2
• .pol
• .ppd
• .prefpane
• .prf
• .printerexport
• .ps2
• .pwl
• .rc1
• .rc2
• .rco
• .reg
• .regtrans-ms
• .rfw
• .rmt
• .rs
• .ruf
• .savedsearch
• .sbn
• .scap
• .scf
• .scr
• .shd
• .shsh
• .swp
• .sys
• .tdz
• .tha
• .theme
• .trx_dll
• .uce
• .vga
• .vgd
• .vx_
• .vxd
• .webpnp
• .wer
• .wph
• .wpx
• .xfb
• .xrm-ms
• .dat
• .db
• .dll
• .dmp
• .ics
• .mod
• .mpa
• .msu
• .nomedia
• .ocx
• .ps1
• .rom
• .rtp
• .shs
• .spl
• .themepack
• .0
• .000
• .amlv
• .automaticdestinations-ms
• .bashrc
• .bash_history
• .bash_profile
• .bin
• .bk1
• .bom
• .c32
• .cat
• .cgz
• .chg
• .chk
• .cht
• .clb
• .cpr
• .crash
• .dlx
• .dvd
• .edj
• .elf
• .emerald
• .etl
• .evt
• .fid
• .fpbf
• .help
• .idx
• .ius
• .job
• .lfs
• .lockfile
• .lst
• .mbr
• .mem
• .metadata_never_index
• .panic
• .pat
• .pit
• .pnf
• .ppm
• .profile
• .prt
• .qvm
• .saver
• .sbf
• .schemas
• .sdb
• .searchconnector-ms
• .sfcache
• .so.0
• .sqm
• .str
• .wdf
• .wdgt
• .wgz
• .zone.identifier

It avoids encrypting files found in the following folders:

• D:\owncloud
• D:\gdrive

It appends the following extension to the file name of the encrypted files:

• ={Random 5 Digit Number}=hello@boomfile.ru.crypt12

It drops the following file(s) as ransom note:

• {Folder Path of Encrypted Files}\!!!!readme!!!.txt