RANSOM_CRYPTWELVE.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Temp%\wallpaper.bmp
• %Desktop%\sys.bat <-used to terminate the ransomware

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %Temp%\wallpaper.bmp

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• .crypt12
• .tmp
• .sep
• .tlb
• .tbl
• .tsp
• .cmd
• .ax
• .olb
• .com
• .acm
• .edb
• .ini
• .exe
• .386
• .73u
• .8xu
• .adm
• .adml
• .admx
• .ani
• .ann
• .aos
• .asec
• .bio
• .bk2
• .blf
• .bmk
• .bud
• .cab
• .cdmp
• .chs
• .ci
• .cnt
• .cpi
• .cpl
• .cpq
• .cur
• .desklink
• .deskthemepack
• .dev
• .diagcab
• .diagcfg
• .diagpkg
• .dimax
• .dit
• .drv
• .dss
• .dyc
• .ebd
• .efi
• .evtx
• .ffa
• .ffl
• .ffo
• .ffx
• .ftg
• .fts
• .gmmp
• .grl
• .group
• .grp
• .h1s
• .hdmp
• .hhc
• .hhk
• .hiv
• .hlp
• .hpj
• .hsh
• .htt
• .icl
• .icns
• .ico
• .idi
• .ifw
• .ime
• .img3
• .inf_loc
• .ins
• .ion
• .ipod
• .itemdata-ms
• .its
• .jpn
• .kbd
• .key
• .kor
• .library-ms
• .lnk
• .log1
• .log2
• .lpd
• .manifest
• .mapimail
• .mdmp
• .mi4
• .mlc
• .mobileconfig
• .msc
• .msp
• .msstyle
• .msstyles
• .mui
• .mui_cccd5ae0
• .mum
• .mydocs
• .nb0
• .nbh
• .nfo
• .nls
• .nt
• .ntfs
• .p7b
• .pck
• .pdr
• .pfx
• .pid
• .pk2
• .pol
• .ppd
• .prefpane
• .prf
• .printerexport
• .ps2
• .pwl
• .rc1
• .rc2
• .rco
• .reg
• .regtrans-ms
• .rfw
• .rmt
• .rs
• .ruf
• .savedsearch
• .sbn
• .scap
• .scf
• .scr
• .shd
• .shsh
• .swp
• .sys
• .tdz
• .tha
• .theme
• .trx_dll
• .uce
• .vga
• .vgd
• .vx_
• .vxd
• .webpnp
• .wer
• .wph
• .wpx
• .xfb
• .xrm-ms
• .dat
• .db
• .dll
• .dmp
• .ics
• .mod
• .mpa
• .msu
• .nomedia
• .ocx
• .ps1
• .rom
• .rtp
• .shs
• .spl
• .themepack
• .0
• .000
• .amlv
• .automaticdestinations-ms
• .bashrc
• .bash_history
• .bash_profile
• .bin
• .bk1
• .bom
• .c32
• .cat
• .cgz
• .chg
• .chk
• .cht
• .clb
• .cpr
• .crash
• .dlx
• .dvd
• .edj
• .elf
• .emerald
• .etl
• .evt
• .fid
• .fpbf
• .help
• .idx
• .ius
• .job
• .lfs
• .lockfile
• .lst
• .mbr
• .mem
• .metadata_never_index
• .panic
• .pat
• .pit
• .pnf
• .ppm
• .profile
• .prt
• .qvm
• .saver
• .sbf
• .schemas
• .sdb
• .searchconnector-ms
• .sfcache
• .so.0
• .sqm
• .str
• .wdf
• .wdgt
• .wgz
• .zone.identifier

It appends the following extension to the file name of the encrypted files:

• ={cryptid}=mortalis_certamen@{BLOCKED}l.com.crypt12

NOTES:

When executed, this ransomware shows the following window:

Begin button encrypts the selected drive.

Hide button hides the window.

Checkboxes on the right select which drive to encrypt.

After encryption, it sets desktop wallpaper to:

p>

After encryption, it terminates and deletes itself using its dropped file %Desktop%\sys.bat.