Ransom.Win32.CRING.C

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• {Malware Filepath}\Go.bat "{Malware Filepath}\{Malware Filename}.exe"
• wmic shadowcopy delete
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• bcdedit /set {default} recoveryenabled no
• {Malware Filepath}\killme.bat "{Malware Filepath}\{Malware Filename}.exe"

It executes then deletes itself afterward.

Other System Modifications

This Ransomware deletes the following files:

• {Malware Filepath}\Go.bat
• {Malware Filepath}\killme.bat
• • {Drive Letter} are the following:
    • D:\
    • E:\
    • F:\
    • G:\
    • H:\
  • {Filename} are files that satisfies the following filters:
    • *.VHD
    • *.bac
    • *.bak
    • *.wbcat
    • *.bkf
    • *.set
    • *.win
    • *.dsk
    • Backup*.*
    • backup*.*

Process Termination

This Ransomware terminates the following services if found on the affected system:

• Services that start with:
  • mssql
  • sql
  • postgresql
  • oracle
  • mysql
  • veeam
  • backup
  • msexchange

Dropping Routine

This Ransomware drops the following files:

• {Malware Filepath}\Go.bat
• {Malware Filepath}\killme.bat

Other Details

This Ransomware encrypts files with the following extensions:

• .xlsx
• .png
• .fob
• .jp?
• .lic
• .dcm
• .cf?
• .rvt
• .cpp
• .qb?
• .cs
• .sln
• .vb
• .xml
• .dwg
• .edb
• .ndf
• .wk
• .xl?
• .txt
• .doc?
• .md?
• mp?
• .sql
• .bak
• .ora
• .pdf
• .pp?
• .dbf
• .zip
• .rar
• .asp?
• .php
• .jsp?
• .bk?
• .csv
• .7z
• .myd
• .ibd
• _fsm
• _vm
• .db?
• .rpt

It does the following:

• Argument must be equal to "rsa" to proceed in encrypting files
• It writes the following to the command prompt:
  • "What the FUck" → before the encryption routine
  • "EZ Games" → after the encryption routine

It requires being executed with a specific argument/parameter, an additional component, or in a specific environment in order to proceed with its intended routine.

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• %Windows%

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• {BLOCKED}ackers@tutanota.com.cring

It drops the following file(s) as ransom note:

• %System Root%\!!!deReadMe!!!.rtf
• %Public%\Desktop\!!!deReadMe!!!.rtf