Ransom.Win32.CLOP.K

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {execution path}\system_binwin32.bat
• {malware path}\settings.ini

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• !!!MONEYMONEYMONEY!!!

Autostart Technique

This Ransomware starts the following services:

• Service Name: AirCraftMonitoringSvrPrc
  Service Type: 16

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• mysqld-opt.exe
• xfssvccon.exe
• thebat.exe
• ocautoupds.exe
• wordpad.exe
• mysqld-nt.exe
• thebat64.exe
• excel.exe
• thunderbird.exe
• agntsvc.exeagntsvc.exe
• zoolz.exe
• msaccess.exe
• sqlwriter.exe
• WINWORD.EXE
• THEBAT.EXE
• VISIO.EXE
• MSFTESQL.EXE
• ORACLE.EXE
• MYDESKTOPQOS.EXE

Other Details

This Ransomware does the following:

• It will delete and terminate itself:
  • If the keyboard layout is any of the following:
    • Georgian
    • Korean
    • Azerbaijani
    • Kazakh
    • Kyrgyz
    • Turkmen
    • Uzbek
  • If the default language ID is as follows:
    • Russian
• It will drop and execute "{execution path}\system_binwin32.bat" if the following processes are not found:
  • SBAMTray.exe
  • VipreAAPSvc.exe
  • MCSHIELD.EXE
  • SBPIMSvc.exe
  • SBAMSvc.exe
  • mctray.exe
  • WRSA.exe
  • MCSACORE.EXE
  • naPrdMgr.exe
  • masvc.exe
  • MCSVHOST.EXE
• It executes the following commands to edit the boot configuration data file
  • bcdedit /set {default} recoveryenabled No
  • bcdedit /set {default} bootstatuspolicy ignoreallfailures
• It executes the following commands to delete and resize the shadow copies:
  • vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
  • vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  • vssadmin Delete Shadows /all /quiet
• It encrypts all files except the following:
  • .Clop
  • Clopreadme.txt
  • ntldr
  • NTLDR
  • boot.ini
  • BOOT.INI
  • ntuser.ini
  • NTUSER.INI
  • AUTOEXEC.BAT
  • autoexec.bat
  • NTDETECT.COM
  • ntdetect.com
  • .dll
  • .DLL
  • .exe
  • .EXE
  • .sys
  • .SYS
  • .OCX
  • .ocx
  • .LNK
  • .lnk
  • desktop.ini
  • autorun.inf
  • ntuser.dat
  • iconcache.db
  • bootsect.bak
  • ntuser.dat.log
  • thumbs.db
  • DESKTOP.INI
  • AUTORUN.INF
  • NTUSER.DAT
  • ICONCACHE.DB
  • bootsect.bak
  • NTUSER.DAT.LOG
  • THUMBS.DB
• It encrypts files which can be found in the following locations:
  • Removable Drives
  • Fixed Drives
• The batch file "{execution path}\system_binwin32.bat" contains the following strings:
  • @echo off
    vssadmin Delete Shadows /all /quiet
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    vssadmin Delete Shadows /all /quiet
    bcdedit /set {default} recoveryenabled No
    bcdedit /set {default} bootstatuspolicy ignoreallfailures

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .CIop

It leaves text files that serve as ransom notes containing the following text:

• {encrypted directory}\CIopReadMe.txt